CVE-2025-7730 Overview
CVE-2025-7730 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Bold Page Builder plugin for WordPress. The flaw affects all versions up to and including 5.4.5. It stems from insufficient input sanitization and output escaping on the percentage parameter used by the plugin's progress bar element. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into pages. The injected payload executes in the browser of any visitor who views the affected page, enabling session theft, redirection, or content manipulation.
Critical Impact
Contributor-level accounts can persist arbitrary JavaScript in WordPress pages that executes against every visitor, including administrators.
Affected Products
- Bold Page Builder plugin for WordPress, versions ≤ 5.4.5
- WordPress sites permitting Contributor-level (or higher) registration
- Any published pages rendering the bt_bb_progress_bar element
Discovery Timeline
- 2025-10-23 - CVE-2025-7730 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-7730
Vulnerability Analysis
The Bold Page Builder plugin ships a bt_bb_progress_bar shortcode that renders a progress indicator based on user-supplied attributes. The percentage parameter is passed through to the HTML output without adequate sanitization or escaping. An authenticated user with the WordPress Contributor role can craft a shortcode where the percentage attribute contains HTML or JavaScript. When the page is rendered, the payload becomes part of the served DOM and executes in the visitor's browser context. Because Contributors can submit posts for review, a malicious contributor can inject persistent script that fires when an editor or administrator previews or publishes the post. The scope-changed impact reflects the fact that code executes within the WordPress origin, extending damage beyond the attacker's own account.
Root Cause
The plugin's progress bar handler concatenates the percentage attribute directly into rendered markup without applying esc_attr(), esc_html(), or absint() normalization. The relevant rendering logic resides in bt_bb_progress_bar.php. Because the value is expected to be numeric, casting to an integer would prevent script content from surviving output.
Attack Vector
An attacker first authenticates to a target WordPress site with a Contributor (or higher) account. They create or edit a post using the Bold Page Builder progress bar element and supply a malicious value for the percentage attribute containing an HTML event handler or <script> payload. Once the post is rendered by any user — including reviewers, editors, and administrators — the injected script executes with the privileges of that user's browser session. See the Wordfence Vulnerability Report for additional technical details.
Detection Methods for CVE-2025-7730
Indicators of Compromise
- Post or page content containing bt_bb_progress_bar shortcodes with non-numeric percentage values.
- Database rows in wp_posts where post_content includes percentage=" followed by HTML tags, quotes, or event handlers such as onerror, onmouseover, or <script.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing Contributor-authored content.
Detection Strategies
- Query the WordPress database for shortcode usage: SELECT ID, post_author FROM wp_posts WHERE post_content REGEXP 'bt_bb_progress_bar[^\]]*percentage="[^0-9"]';
- Review the plugin version reported by wp plugin list and flag installations at or below 5.4.5.
- Enable browser-side Content Security Policy (CSP) reporting to surface inline script execution originating from post content.
Monitoring Recommendations
- Audit new Contributor and Author account creation, particularly on sites with open registration.
- Log and review all post revisions submitted by non-Editor roles for embedded HTML in shortcode attributes.
- Alert on administrator sessions that trigger unusual DOM modifications or outbound XHR requests shortly after previewing pending posts.
How to Mitigate CVE-2025-7730
Immediate Actions Required
- Update the Bold Page Builder plugin to a version above 5.4.5 as soon as the vendor publishes a fix. Consult the plugin developer page for release information.
- Audit existing posts and pages for malicious bt_bb_progress_bar shortcode attributes and remove or sanitize them.
- Reduce the WordPress role assigned to untrusted publishers; deny Contributor access where it is not required.
Patch Information
At the time of NVD publication, all versions up to and including 5.4.5 are affected. Site operators should monitor the Bold Page Builder repository for a patched release and apply the update immediately. Until a fix is available, treat the plugin as vulnerable on any site with Contributor-or-higher accounts held by non-trusted users.
Workarounds
- Deactivate the Bold Page Builder plugin on sites where the progress bar element is not required.
- Restrict shortcode usage by removing or filtering bt_bb_progress_bar through a mu-plugin that calls remove_shortcode('bt_bb_progress_bar').
- Enforce a strict Content Security Policy that blocks inline script execution to limit payload impact.
- Require review of all Contributor submissions by a trusted editor before publication.
# Configuration example: quickly identify vulnerable installations and audit content
wp plugin list --name=bold-page-builder --fields=name,version,status
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
WHERE post_status IN ('publish','pending','draft') \
AND post_content REGEXP 'bt_bb_progress_bar[^\\]]*percentage=\"[^0-9\"]';"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
