CVE-2026-6172: Bold Page Builder WordPress XSS Vulnerability

CVE-2026-6172 Overview

CVE-2026-6172 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress. The flaw resides in the caption parameter of the plugin's bt_bb_image shortcode. All versions up to and including 5.7.2 are affected due to insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes in the browser of any visitor to the affected page. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Contributor-level users can persist arbitrary JavaScript in WordPress pages, enabling session theft, administrative account takeover, and drive-by browser attacks against any visitor.

Affected Products

Bold Page Builder plugin for WordPress, all versions through 5.7.2
WordPress sites permitting Contributor-level (or higher) user registration
Any published page or post embedding the bt_bb_image shortcode

Discovery Timeline

2026-09-30 - CVE-2026-6172 published to the National Vulnerability Database
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-6172

Vulnerability Analysis

The vulnerability is a Stored XSS flaw in the bt_bb_image shortcode handler located in content_elements/bt_bb_image/bt_bb_image.php. When rendering the shortcode, the plugin accepts a caption attribute from user input and emits it into the page markup without adequate sanitization or output escaping.

Because the payload is stored in post content, it executes each time a reader loads the affected page. The scope is Changed in the CVSS vector, indicating the injected script runs in the security context of any visiting browser, including administrators. Successful exploitation can lead to session hijacking, forced administrative actions via authenticated CSRF, credential harvesting through injected forms, and redirection to attacker-controlled infrastructure.

Root Cause

The root cause is missing input sanitization on the caption shortcode attribute combined with the absence of output escaping when the value is written into HTML. WordPress provides sanitize_text_field() for input filtering and esc_attr() or esc_html() for context-aware output escaping. Neither was applied to the caption value before rendering. Refer to the WordPress Plugin Change Log for the corrective change.

Attack Vector

An attacker first obtains Contributor-level access, either through open registration or credential compromise. The attacker creates or edits a post containing the bt_bb_image shortcode with a caption attribute containing an HTML or JavaScript payload. Once a higher-privileged user previews or publishes the post, or any visitor loads the page, the malicious script executes in the visitor's browser. See the Wordfence Vulnerability Report for advisory details.

Detection Methods for CVE-2026-6172

Indicators of Compromise

Posts or pages containing bt_bb_image shortcodes with caption values that include <script>, onerror, onload, or javascript: sequences
Unexpected outbound requests from visitor browsers to unfamiliar domains after loading pages built with Bold Page Builder
New administrator accounts, plugin installations, or user role changes originating from Contributor sessions
Anomalous edits to published posts by Contributor-level accounts

Detection Strategies

Audit the wp_posts table for shortcode strings matching bt_bb_image with suspicious caption attribute content
Deploy a Web Application Firewall (WAF) ruleset that blocks script tags and event handlers in shortcode parameters
Enforce a strict Content Security Policy (CSP) and monitor CSP violation reports for inline-script blocks
Correlate Contributor account activity with post edits containing HTML entities or encoded payloads

Monitoring Recommendations

Log and review all post creation and revision events initiated by non-editor roles
Alert on plugin, theme, or user-role modifications performed shortly after Contributor logins
Monitor authentication events for Contributor accounts exhibiting unusual geolocation or user-agent patterns

How to Mitigate CVE-2026-6172

Immediate Actions Required

Update the Bold Page Builder plugin to the version released after changeset 3526548 on all WordPress sites
Audit Contributor, Author, and Editor accounts and disable any that are unused or unrecognized
Scan existing post content for the bt_bb_image shortcode and remove or sanitize suspicious caption values
Rotate credentials and invalidate active sessions for administrators who may have viewed compromised pages

Patch Information

The vendor addressed the flaw in the upstream repository as documented in changeset 3526548. Site operators should upgrade to the fixed release published after this changeset and verify the patched file in content_elements/bt_bb_image/bt_bb_image.php.

Workarounds

Temporarily deactivate the Bold Page Builder plugin until the patched version is deployed
Restrict user registration and require administrator approval for any Contributor-level or higher role
Deploy a WAF rule blocking <script, on*=, and javascript: patterns inside shortcode attributes
Apply a Content Security Policy that disallows inline scripts and untrusted script sources

bash

# Example WordPress CLI actions to mitigate exposure
wp plugin update bold-page-builder
wp user list --role=contributor --format=table
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%bt_bb_image%caption=%<%';"