CVE-2026-62110 Overview
CVE-2026-62110 is a stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress, affecting versions 5.9.9 and earlier. The flaw allows authenticated users with Contributor-level privileges to inject malicious JavaScript that executes in the browsers of other users viewing affected content. The issue is categorized under CWE-79, Improper Neutralization of Input During Web Page Generation.
Because exploitation requires user interaction and low-privileged authentication, the vulnerability is rated MEDIUM. However, the scope change means injected scripts can affect resources beyond the vulnerable component, including administrator sessions.
Critical Impact
A Contributor-level account can inject persistent JavaScript that runs when higher-privileged users view the affected page, enabling session theft, forced administrative actions, and further site compromise.
Affected Products
- Bold Page Builder WordPress plugin versions <= 5.9.9
- WordPress installations running the vulnerable plugin with Contributor-or-higher accounts
- Any site rendering content authored by untrusted contributors through Bold Page Builder
Discovery Timeline
- 2026-09-11 - CVE-2026-62110 published to NVD
- 2026-09-11 - Last updated in NVD database
Technical Details for CVE-2026-62110
Vulnerability Analysis
The vulnerability stems from insufficient input sanitization and output escaping within the Bold Page Builder plugin. A Contributor-level user can supply crafted input through plugin-controlled fields that is later rendered without proper encoding. When another user loads the page, the browser interprets the injected payload as executable script.
The scope change indicates the injected script can act outside the plugin's own security context. This makes the flaw useful for privilege escalation chains, particularly when an administrator previews or reviews Contributor-authored content. The EPSS probability sits at 0.161%, reflecting low observed exploitation activity to date.
Root Cause
The root cause is missing or inadequate neutralization of user-supplied HTML and JavaScript in one or more Bold Page Builder input handlers. Content submitted by Contributors is stored and later reflected into rendered pages without the escaping controls WordPress provides through functions such as esc_html(), esc_attr(), and wp_kses().
Attack Vector
Exploitation requires network access, low privileges, and user interaction. An authenticated Contributor submits a page or element containing a JavaScript payload through a Bold Page Builder field. When an editor or administrator opens the resulting page in the admin panel or on the front end, the payload executes in that user's browser session.
Refer to the Patchstack XSS Vulnerability Report for the specific vulnerable parameters and payload structure.
Detection Methods for CVE-2026-62110
Indicators of Compromise
- Unexpected <script>, onerror, onload, or javascript: strings stored in WordPress post content, post meta, or Bold Page Builder configuration tables.
- Contributor accounts submitting or editing pages containing HTML entities that decode to executable JavaScript.
- Administrator sessions generating unusual outbound requests or WordPress REST API calls shortly after previewing Contributor content.
Detection Strategies
- Query the wp_posts and wp_postmeta tables for suspicious tags in content authored by Contributor-role users.
- Enable and review WordPress audit logs for post revisions submitted by Contributor accounts targeting Bold Page Builder elements.
- Deploy a Web Application Firewall (WAF) rule set that flags stored HTML event handlers and script tags in plugin-specific POST parameters.
Monitoring Recommendations
- Alert on new administrator account creation, role changes, or plugin installations following a Contributor content submission.
- Track browser Content Security Policy (CSP) violation reports for the WordPress admin origin.
- Monitor for outbound requests from admin browsers to unknown domains, which may indicate cookie or token exfiltration.
How to Mitigate CVE-2026-62110
Immediate Actions Required
- Update Bold Page Builder to a version newer than 5.9.9 as soon as the vendor publishes a fixed release.
- Audit all existing Contributor-authored content for injected script or event handler attributes and remove offending entries.
- Temporarily restrict the Contributor role or require editor approval before Contributor content is previewed by administrators.
Patch Information
The Patchstack advisory tracks the fixed version. Administrators should verify the plugin version reported in the WordPress dashboard matches or exceeds the patched release before restoring normal Contributor workflows.
Workarounds
- Disable the Bold Page Builder plugin on sites where a patched version is not yet available.
- Remove or downgrade untrusted Contributor accounts until the plugin is updated.
- Deploy a strict Content Security Policy that forbids inline scripts in the WordPress admin interface to reduce payload execution.
- Place a WAF in front of /wp-admin/ and /wp-json/ endpoints to filter XSS payloads targeting Bold Page Builder parameters.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
