CVE-2025-58194: Bold Page Builder Stored XSS Vulnerability

CVE-2025-58194 Overview

CVE-2025-58194 is a stored cross-site scripting (XSS) vulnerability in the boldthemes Bold Page Builder plugin for WordPress. The flaw affects all versions up to and including 5.4.3. Improper neutralization of user-supplied input during web page generation allows an authenticated attacker with low privileges to inject persistent JavaScript payloads. When another user renders the affected page, the payload executes in their browser session.

The issue is categorized under CWE-79. Exploitation requires user interaction and low-privilege access, and the vulnerability crosses a security scope boundary due to the WordPress admin execution context.

Critical Impact
Authenticated attackers can inject persistent scripts that execute in administrator or visitor browsers, enabling session hijacking, credential theft, and unauthorized site modification.

Affected Products

boldthemes Bold Page Builder plugin for WordPress
Versions from initial release through 5.4.3
WordPress sites with the plugin enabled and low-privilege authenticated users permitted

Discovery Timeline

2025-08-27 - CVE-2025-58194 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58194

Vulnerability Analysis

The vulnerability stems from insufficient sanitization of input processed by the Bold Page Builder plugin during page generation. Attacker-controlled data reaches the rendered HTML without adequate encoding or filtering. The stored nature of the flaw means the malicious payload persists in the WordPress database and executes each time an affected page is loaded.

Because the attack vector is network-based and the scope changes upon successful exploitation, injected scripts can act beyond the attacker's original privilege boundary. Administrators viewing a poisoned page can have their sessions abused to install plugins, create accounts, or modify site content.

Root Cause

The root cause is improper neutralization of input during web page generation, tracked as CWE-79. Plugin code responsible for rendering builder-driven content fails to apply WordPress escaping helpers such as esc_html(), esc_attr(), or wp_kses_post() on attacker-controlled fields. As a result, HTML and JavaScript submitted through builder inputs are stored verbatim and echoed into pages.

Attack Vector

An authenticated user with content-editing capability submits a crafted payload through a Bold Page Builder input field that is later rendered without escaping. The payload is written to the database and served to any visitor who loads the page. Successful exploitation requires the victim to load or interact with the rendered content. Refer to the Patchstack advisory for the technical writeup.

Detection Methods for CVE-2025-58194

Indicators of Compromise

Unexpected <script> tags, event handlers such as onerror= or onclick=, or javascript: URIs stored inside wp_postmeta or wp_posts rows created by Bold Page Builder
Outbound requests from administrator browsers to unfamiliar domains shortly after loading affected pages
New administrator accounts or plugin installations that correlate with page views by privileged users

Detection Strategies

Query the WordPress database for post content and postmeta values containing <script, onerror, or onload associated with Bold Page Builder shortcodes
Review web server access logs for POST requests to admin endpoints originating from low-privilege accounts that modify builder content
Compare the installed plugin version against 5.4.3 and flag any host running the affected release

Monitoring Recommendations

Enable WordPress audit logging for content edits performed by non-administrator roles
Forward WordPress and web server logs to a centralized analytics platform for correlation with browser-side alerts
Monitor for browser Content Security Policy (CSP) violation reports referencing WordPress pages built with the plugin

How to Mitigate CVE-2025-58194

Immediate Actions Required

Identify all WordPress sites running Bold Page Builder version 5.4.3 or earlier and prioritize them for update
Restrict content-editing capabilities to trusted users until patching is complete
Audit existing pages built with the plugin for embedded scripts or suspicious HTML attributes

Patch Information

At the time of NVD publication, the vulnerability affects versions up to and including 5.4.3. Site administrators should consult the Patchstack advisory and the vendor plugin page for the latest fixed release, then update through the WordPress plugin manager.

Workarounds

Deploy a web application firewall rule that blocks HTML and JavaScript in Bold Page Builder request parameters
Enforce a strict Content Security Policy that disallows inline scripts on public pages
Temporarily disable the Bold Page Builder plugin on affected sites until the update is applied

bash

# Configuration example
wp plugin list --name=bold-page-builder --fields=name,status,version
wp plugin update bold-page-builder
wp plugin deactivate bold-page-builder   # if no patched version is yet available