CVE-2026-7438: Bold Timeline Lite WordPress XSS Vulnerability

CVE-2026-7438 Overview

CVE-2026-7438 is a stored Cross-Site Scripting (XSS) vulnerability in the Bold Timeline Lite plugin for WordPress. The flaw affects all versions up to and including 1.2.8. It stems from insufficient input sanitization and output escaping on the supertitle and subtitle attributes of the bold_timeline_item shortcode. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes when visitors load an affected page. The vulnerability is classified as Improper Neutralization of Input During Web Page Generation [CWE-79].

Critical Impact
Contributor-level accounts can plant persistent JavaScript payloads that execute in the browser of any user, including administrators, who views the injected content.

Affected Products

Bold Timeline Lite plugin for WordPress, all versions ≤ 1.2.8
Vulnerable shortcode: bold_timeline_item (supertitle and subtitle attributes)
Vulnerable views: assets/views/bold_timeline_item_view.php (lines 202 and 204)

Discovery Timeline

2026-09-11 - CVE-2026-7438 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-7438

Vulnerability Analysis

The Bold Timeline Lite plugin registers the bold_timeline_item shortcode to render timeline entries on WordPress pages and posts. When the shortcode renders, the supertitle and subtitle attribute values are echoed into the HTML output without adequate escaping. Any user permitted to author shortcode content, which in WordPress includes the Contributor role by default, can supply attribute values that contain HTML or JavaScript. That content is stored in post data and served to every subsequent visitor of the page.

Because the payload persists in the database and executes in the browsers of higher-privileged users who preview or approve posts, an attacker can pivot from Contributor to site takeover. Typical follow-on actions include stealing authenticated session cookies, forcing administrative requests, injecting backdoor accounts, and rewriting site content.

Root Cause

The root cause is missing output escaping in bold_timeline_item_view.php. Attribute values received by the shortcode handler in content_elements/bold_timeline_item/bold_timeline_item.php flow directly into the rendered template without functions such as esc_html(), esc_attr(), or wp_kses() filtering the content. See the Bold Timeline Item View Code and line 204 for the vulnerable sinks.

Attack Vector

Exploitation requires an authenticated account with Contributor privileges or higher. The attacker submits a draft post containing the bold_timeline_item shortcode with malicious script content placed in the supertitle or subtitle attribute. When an editor, administrator, or public visitor loads the resulting page, the injected script runs in their browser session under the site origin. The scope change reflected in the vulnerability metrics indicates that the impact extends beyond the vulnerable component to affected user browsers.

Refer to the Wordfence Vulnerability Analysis and the plugin changeset for technical details on the fix.

Detection Methods for CVE-2026-7438

Indicators of Compromise

Post or page content containing [bold_timeline_item ...] shortcodes with supertitle or subtitle attribute values holding HTML tags such as <script>, <img onerror=...>, or <svg onload=...>.
Unexpected outbound requests from browsers rendering timeline pages to attacker-controlled domains.
New administrator accounts or modified user roles created shortly after Contributor-authored posts are published.

Detection Strategies

Query the wp_posts table for post_content entries matching the pattern bold_timeline_item combined with <, javascript:, or on\w+= to identify injected attributes.
Review WordPress audit logs for Contributor accounts creating or updating posts that include the vulnerable shortcode.
Inspect served HTML for unescaped script content within .bold-timeline markup rendered by the plugin.

Monitoring Recommendations

Enable a Web Application Firewall (WAF) rule set that blocks XSS payloads in shortcode attributes submitted to admin-ajax.php and post.php.
Monitor plugin version inventory across all WordPress sites and alert when Bold Timeline Lite ≤ 1.2.8 is detected.
Log browser Content Security Policy (CSP) violation reports to surface script execution attempts on pages rendering timeline content.

How to Mitigate CVE-2026-7438

Immediate Actions Required

Update the Bold Timeline Lite plugin to the version released in changeset 3556837 or later.
Audit all existing timeline shortcodes and remove any supertitle or subtitle attribute values containing HTML, script tags, or event handlers.
Restrict Contributor and Author role assignments to trusted users and review recent role changes.

Patch Information

The vendor addressed the flaw in the Bold Timeline Lite changeset 3556837, which adds output escaping to the affected attributes in bold_timeline_item_view.php. Update through the WordPress plugin manager or download the current release from the WordPress Bold Timeline Lite Plugin page.

Workarounds

Deactivate and remove the Bold Timeline Lite plugin until the patched version can be deployed.
Deploy a WAF rule that blocks POST parameters containing bold_timeline_item shortcodes with <script, javascript:, or on\w+= payloads.
Enforce a strict Content Security Policy that disallows inline script execution to reduce the impact of any residual injection.

bash

# Configuration example: enumerate site posts containing the vulnerable shortcode
wp post list --post_type=post,page --format=ids \
  | xargs -I {} wp post get {} --field=post_content \
  | grep -nE 'bold_timeline_item.*(supertitle|subtitle)="[^"]*<'