CVE-2026-84022 Overview
CVE-2026-84022 is a stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress. The flaw affects all versions prior to 5.9.8. The plugin fails to sanitize and escape several shortcode attributes before outputting them inside HTML attributes. Authenticated users holding the Contributor role or higher can inject arbitrary JavaScript that executes in the browser of any visitor viewing the affected page. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated contributors can persist arbitrary scripts in published pages, enabling session hijacking, administrator account takeover, and malicious redirection of site visitors.
Affected Products
- Bold Page Builder WordPress plugin versions before 5.9.8
- WordPress sites where the plugin is installed and Contributor-or-higher accounts exist
- Any front-end page rendering vulnerable shortcodes from the plugin
Discovery Timeline
- 2026-09-05 - CVE-2026-84022 published to the National Vulnerability Database
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-84022
Vulnerability Analysis
The vulnerability resides in the shortcode handling logic of the Bold Page Builder plugin. The plugin accepts multiple attributes through its shortcodes and reflects those values directly into HTML attributes when rendering front-end content. Because the values are neither sanitized on input nor escaped on output, attacker-controlled strings can break out of the surrounding attribute context and introduce new event handlers or <script> payloads. Any visitor who loads the affected page executes the injected code under the site's origin. This enables theft of authentication cookies, forced administrative actions, and pivot attacks against higher-privileged users such as editors and administrators.
Root Cause
The plugin performs no call to WordPress escaping helpers such as esc_attr() before echoing shortcode attribute values into the rendered markup. Contributor-level accounts, which are normally trusted to submit content for review, can supply crafted attribute values inside a shortcode. When an editor or administrator previews or publishes the content, the malicious markup is stored and served to every subsequent visitor.
Attack Vector
An attacker registers or compromises a Contributor account, then submits a post containing a Bold Page Builder shortcode with a payload placed inside one of the vulnerable attributes. Once the post is viewed, the payload executes in the visitor's session. The full technical write-up is available in the WPScan Vulnerability Report.
No verified proof-of-concept code is published. The exploitation pattern follows the standard stored XSS model: inject a payload that closes the current HTML attribute quote and appends an inline event handler such as onmouseover or onerror.
Detection Methods for CVE-2026-84022
Indicators of Compromise
- Posts or pages containing Bold Page Builder shortcodes with attribute values containing <script>, on*= event handlers, javascript: URIs, or unbalanced quote characters
- Unexpected outbound requests from visitor browsers to attacker-controlled domains after loading pages built with the plugin
- New administrator accounts or altered user roles created shortly after a Contributor submitted content
- Contributor accounts submitting posts that reference the plugin's shortcodes despite not having page-builder responsibilities
Detection Strategies
- Review the wp_posts table for shortcode attributes containing HTML metacharacters or JavaScript keywords
- Enable server-side logging of shortcode rendering and alert on attribute values that contain angle brackets or quote-breaking sequences
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions originating from published pages
Monitoring Recommendations
- Monitor WordPress audit logs for Contributor role assignments and unusual post submission patterns
- Track plugin version inventory across managed WordPress deployments and flag any Bold Page Builder installation below 5.9.8
- Alert on newly created administrator accounts, changes to the siteurl option, or modifications to active theme files following visitor traffic to Contributor-authored pages
How to Mitigate CVE-2026-84022
Immediate Actions Required
- Update the Bold Page Builder plugin to version 5.9.8 or later on every WordPress site
- Audit all Contributor, Author, and Editor accounts and remove any that are unused or unrecognized
- Review recently submitted or published posts containing plugin shortcodes for injected script content
- Rotate administrator session cookies and passwords if suspicious content is found
Patch Information
The vendor addressed the issue in Bold Page Builder version 5.9.8 by adding proper sanitization and escaping to the affected shortcode attributes. Refer to the WPScan Vulnerability Report for the advisory details and fixed version reference.
Workarounds
- Restrict Contributor account creation and require administrator approval for new registrations until the patch is applied
- Temporarily deactivate the Bold Page Builder plugin on sites that cannot be updated immediately
- Enforce a strict Content Security Policy that blocks inline scripts and unauthorized event handlers on the front end
- Deploy a Web Application Firewall (WAF) rule that inspects post content for shortcode attribute values containing script tags or event handler syntax
# Example WP-CLI commands to identify and update vulnerable installations
wp plugin get bold-page-builder --field=version
wp plugin update bold-page-builder --version=5.9.8
wp user list --role=contributor --fields=ID,user_login,user_registered
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
