CVE-2026-5920 Overview
CVE-2026-5920 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress. The flaw affects all plugin versions up to and including 5.9.6. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages through the shortcode_content parameter of the bt_bb_shortcode shortcode. The injected scripts execute in the browser of any user who views the affected page. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Authenticated contributors can bypass the plugin's security filter using null byte injection to store persistent JavaScript payloads that execute against site visitors and administrators.
Affected Products
- Bold Page Builder plugin for WordPress
- All versions up to and including 5.9.6
- WordPress sites allowing Contributor-level accounts or higher
Discovery Timeline
- 2026-09-16 - CVE-2026-5920 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-5920
Vulnerability Analysis
The vulnerability resides in the shortcode processing pipeline of the Bold Page Builder plugin. The bt_bb_shortcode shortcode accepts a shortcode_content parameter that is processed by the bt_bb_raw_content handler. Content passed through this parameter is base64-decoded and rendered in the page without adequate output sanitization.
The plugin implements a pre-save security filter named bt_bb_save_pre intended to strip dangerous content before storage. However, this filter can be bypassed. An authenticated attacker with Contributor privileges can therefore persist a malicious payload into a page and have it executed in the browsers of subsequent visitors, including higher-privileged users such as editors and administrators.
Root Cause
The root cause is twofold. First, the bt_bb_save_pre filter fails to normalize input containing null bytes (\\x00), allowing filter evasion through null byte injection. Second, the bt_bb_raw_content shortcode handler performs base64 decoding on attacker-controlled input and outputs the decoded content without escaping HTML-relevant characters. The combination allows arbitrary <script> payloads to reach the rendered DOM.
Attack Vector
Exploitation requires an authenticated session with Contributor-level access or higher. The attacker crafts a bt_bb_shortcode invocation whose shortcode_content parameter carries a base64-encoded JavaScript payload. Null byte characters are injected in positions that trip the bt_bb_save_pre filter into ignoring the malicious content while leaving it intact for later rendering. When the page is viewed, the bt_bb_raw_content handler decodes and emits the payload into the response, and the browser executes it in the site's origin context. Refer to the Wordfence Vulnerability Report for additional technical detail.
No verified public proof-of-concept code is available; see the WordPress Plugin Change Log for the patched handler.
Detection Methods for CVE-2026-5920
Indicators of Compromise
- Post or page content in wp_posts containing bt_bb_shortcode or bt_bb_raw_content with base64 blobs in the shortcode_content parameter.
- Presence of null byte characters (\\x00 or %00) inside shortcode attributes stored in the database.
- Base64-decoded shortcode content that resolves to <script> tags, event handlers such as onerror=, or references to external JavaScript.
- Contributor or Author accounts creating pending pages containing Bold Page Builder shortcodes shortly before administrative reviews.
Detection Strategies
- Query the WordPress database for post_content values matching bt_bb_shortcode combined with shortcode_content= and decode the base64 payloads for inspection.
- Enable WordPress audit logging for post creation and revision events performed by Contributor-level users.
- Deploy a Web Application Firewall (WAF) rule that inspects shortcode attributes for null byte sequences.
Monitoring Recommendations
- Monitor administrator sessions for unexpected outbound requests originating from admin page previews.
- Alert on new or modified posts submitted by low-privilege roles that contain Bold Page Builder shortcodes.
- Review server access logs for POST requests to wp-admin/post.php and admin-ajax.php carrying encoded null bytes.
How to Mitigate CVE-2026-5920
Immediate Actions Required
- Update the Bold Page Builder plugin to the version released in changeset 3668982 or later.
- Audit existing pages and posts for stored bt_bb_shortcode payloads and remove any containing suspicious base64 or null byte content.
- Rotate credentials for administrator accounts that may have viewed compromised pages.
Patch Information
The vendor addressed the vulnerability in the Bold Page Builder plugin update tracked in changeset 3668982. The fix hardens the bt_bb_raw_content handler and eliminates the null byte bypass in bt_bb_save_pre. Site administrators should apply the update through the WordPress Plugins dashboard or via WP-CLI.
Workarounds
- Temporarily deactivate the Bold Page Builder plugin until the patched version is deployed.
- Restrict Contributor and Author roles from using shortcodes by removing the edit_posts capability or by installing a role management plugin that filters shortcode input.
- Configure a WAF rule to block requests containing %00 inside bt_bb_shortcode attributes.
- Require editor review of all Contributor-submitted posts before publication and inspect raw content for encoded payloads.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
