CVE-2026-6171: Bold Page Builder WordPress Plugin XSS Flaw

CVE-2026-6171 Overview

CVE-2026-6171 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Bold Page Builder plugin for WordPress. The flaw resides in the target parameter of the plugin's bt_bb_icon shortcode and impacts all versions up to and including 5.7.2. Insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript. Injected scripts execute in the browser of any user who visits an affected page, enabling session theft, forced redirects, or actions performed on behalf of higher-privileged users. The issue is tracked as CWE-79.

Critical Impact
Authenticated contributors can persist arbitrary JavaScript in WordPress pages, allowing attackers to hijack sessions or escalate privileges when administrators view the affected content.

Affected Products

Bold Page Builder plugin for WordPress, all versions through 5.7.2
WordPress sites permitting Contributor-level (or higher) accounts
Any pages rendering the bt_bb_icon shortcode with attacker-controlled attributes

Discovery Timeline

2026-09-30 - CVE-2026-6171 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-6171

Vulnerability Analysis

The Bold Page Builder plugin exposes the bt_bb_icon shortcode, which accepts a target attribute intended to control link behavior. The plugin passes this attribute into rendered HTML without sufficient sanitization or context-aware output escaping. An authenticated attacker with Contributor privileges can embed the shortcode inside post content and set target to a payload that breaks out of the attribute context and injects executable script. Because WordPress stores post content in the database, the payload persists and executes whenever the page is rendered in a viewer's browser. The vulnerability carries a changed scope, meaning the impact extends beyond the vulnerable component to affect any user viewing the malicious page.

Root Cause

The root cause is missing input validation and unsafe HTML output for the target shortcode attribute inside bt_bb_icon.php. WordPress provides helpers such as esc_attr() and sanitize_text_field() for exactly this purpose, but the affected code path fails to apply them before echoing the attribute into the rendered markup. The upstream fix is visible in the WordPress plugin changeset 3526548.

Attack Vector

Exploitation requires an authenticated account with Contributor-level access or higher. The attacker creates or edits a post that contains a bt_bb_icon shortcode where the target attribute holds a crafted payload that closes the surrounding attribute and appends an event handler such as onmouseover or onload. Once the post is previewed or published, any visitor rendering the page executes the injected JavaScript in the site's origin. Administrators reviewing pending contributor submissions are prime targets, since their sessions can be leveraged to install plugins, create accounts, or modify site configuration.

No verified public proof-of-concept code is available. Refer to the Wordfence vulnerability report for additional technical detail.

Detection Methods for CVE-2026-6171

Indicators of Compromise

Post or page content containing bt_bb_icon shortcodes with unusual target attribute values that include quote characters, angle brackets, or on*= event handlers.
Unexpected <script> tags, javascript: URIs, or DOM event handlers rendered inside pages built with Bold Page Builder.
Contributor accounts submitting or editing posts containing shortcode attributes with encoded payloads such as " or %22.
Outbound requests from administrator browsers to unfamiliar domains immediately after previewing contributor-submitted content.

Detection Strategies

Query the WordPress wp_posts table for post_content matching bt_bb_icon shortcodes and inspect the target attribute for HTML metacharacters.
Enable a Content Security Policy (CSP) in report-only mode to surface inline script executions that violate policy on pages using the plugin.
Review web server access logs for POST requests to /wp-admin/post.php from contributor accounts that include shortcode payloads with suspicious characters.

Monitoring Recommendations

Audit the plugin version reported by WordPress and alert when it is at or below 5.7.2.
Monitor creation and modification of low-privileged accounts, particularly Contributors, and correlate with post edits.
Forward WordPress and web server logs to a centralized analytics platform to correlate authenticated post edits with subsequent script execution or anomalous admin activity.

How to Mitigate CVE-2026-6171

Immediate Actions Required

Update the Bold Page Builder plugin to a version above 5.7.2 that includes the fix from changeset 3526548.
Audit existing posts and pages for bt_bb_icon shortcodes containing suspicious target attribute values and remove or sanitize them.
Review Contributor and higher-privileged accounts, disabling any that are unused or unrecognized.
Rotate administrator session cookies and credentials if injected content has been rendered by privileged users.

Patch Information

The vendor addressed the issue by adding sanitization and escaping to the target attribute of the bt_bb_icon shortcode. The fix is committed in WordPress plugin changeset 3526548. Site operators should upgrade to the first Bold Page Builder release above 5.7.2 that contains this changeset.

Workarounds

Restrict the Contributor role or remove untrusted contributor accounts until the plugin is patched.
Deploy a web application firewall (WAF) rule that blocks POST requests to /wp-admin/post.php containing bt_bb_icon shortcode attributes with quote characters or on*= handlers.
Enforce a strict Content Security Policy that disallows inline scripts and event handlers on public-facing pages.
Require editorial review of contributor-submitted content in a hardened preview environment before publication.

bash

# Example WAF rule (ModSecurity) to block suspicious bt_bb_icon target attributes
SecRule REQUEST_URI "@streq /wp-admin/post.php" \
  "chain,phase:2,deny,status:403,id:1026617,\
   msg:'Potential CVE-2026-6171 bt_bb_icon XSS payload'"
SecRule ARGS "@rx bt_bb_icon[^\]]*target=[\"'][^\"']*(<|on[a-z]+=|javascript:)" \
  "t:none,t:lowercase,t:urlDecodeUni"