CVE-2026-84028: Bold Page Builder WordPress XSS Vulnerability

CVE-2026-84028 Overview

CVE-2026-84028 is a stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder WordPress plugin versions prior to 5.9.9. The plugin fails to sanitize and escape a shortcode attribute before rendering it inside an HTML attribute. Authenticated users with the Contributor role or higher can inject arbitrary JavaScript that executes in the browser of any visitor who views the affected page. The flaw is classified under CWE-79, Improper Neutralization of Input During Web Page Generation.

Critical Impact
Contributor-level users can inject persistent scripts that execute against site visitors and administrators, enabling session theft, privilege escalation, and site defacement.

Affected Products

Bold Page Builder WordPress plugin versions prior to 5.9.9
WordPress sites permitting Contributor or higher role registration
Any WordPress installation using the vulnerable shortcode functionality

Discovery Timeline

2026-09-06 - CVE-2026-84028 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-84028

Vulnerability Analysis

The Bold Page Builder plugin exposes shortcodes that accept user-supplied attributes. One of these attributes is rendered directly into an HTML tag attribute in the generated page markup without proper sanitization or escaping. An authenticated attacker holding the Contributor role or above can craft a shortcode containing a malicious payload that breaks out of the attribute context and injects arbitrary JavaScript.

Because the payload is stored in post content, it executes whenever a user renders the page. This includes editors and administrators previewing or reviewing submitted posts, which enables privilege escalation through session hijacking or forced administrative actions.

Root Cause

The root cause is missing output encoding on a shortcode attribute value prior to inclusion in an HTML attribute. WordPress provides helpers such as esc_attr() for this purpose, but the vulnerable shortcode handler either omits the call or uses insufficient sanitization for the attribute context. This is a classic instance of CWE-79.

Attack Vector

Exploitation requires an authenticated account with at least Contributor privileges and user interaction, since the victim must load the page containing the malicious shortcode. The attacker submits a post or page containing a Bold Page Builder shortcode whose attribute contains JavaScript that breaks out of the HTML attribute quoting. When a reviewer, editor, or site visitor loads the page, the injected script executes in their browser context, inheriting their session and permissions.

Refer to the WPScan Vulnerability Report for technical validation of the shortcode attribute injection path.

Detection Methods for CVE-2026-84028

Indicators of Compromise

Bold Page Builder shortcodes in post content containing quote characters, on* event handlers, javascript: URIs, or <script> fragments
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after previewing Contributor-submitted content
New administrator accounts or modified user roles created without corresponding admin activity logs
Injected <script> tags or event-handler attributes in the rendered HTML of published pages

Detection Strategies

Scan the wp_posts table for Bold Page Builder shortcodes containing suspicious characters or JavaScript keywords in attribute values
Deploy a Web Application Firewall (WAF) rule that inspects POST bodies to wp-admin/post.php for shortcode attributes containing script markers
Enable WordPress audit logging to correlate Contributor post submissions with subsequent administrator page views
Compare currently installed plugin version against the fixed release 5.9.9 using automated plugin inventory tooling

Monitoring Recommendations

Alert on any Contributor or Author account submitting posts containing Bold Page Builder shortcodes with attribute payloads exceeding normal length
Monitor administrator session activity for anomalous API calls following post preview actions
Track privilege changes and new user creations in real time and correlate them to recent post-review events

How to Mitigate CVE-2026-84028

Immediate Actions Required

Update the Bold Page Builder plugin to version 5.9.9 or later on all WordPress installations
Audit existing posts and pages for malicious shortcode attribute content and remove any injected payloads
Review the roster of Contributor, Author, and Editor accounts and revoke unused or untrusted access
Rotate administrator credentials and invalidate active sessions if malicious shortcode content was found

Patch Information

The vendor addressed CVE-2026-84028 in Bold Page Builder version 5.9.9 by adding proper sanitization and escaping to the affected shortcode attribute. Site operators should upgrade through the WordPress plugin dashboard or by replacing plugin files with the fixed release. See the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict content submission privileges by removing the Contributor role from untrusted users until the plugin can be updated
Disable the Bold Page Builder plugin entirely on sites where the update cannot be applied immediately
Deploy WAF rules that block shortcode payloads containing HTML attribute-breaking sequences such as unescaped quotes followed by event handlers
Enforce mandatory administrator review of Contributor submissions in a sandboxed browser profile without active WordPress sessions

bash

# Verify installed Bold Page Builder version via WP-CLI
wp plugin get bold-page-builder --field=version

# Update the plugin to the patched release
wp plugin update bold-page-builder --version=5.9.9

# Search post content for suspicious shortcode payloads
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%[bt_%' AND (post_content LIKE '%onerror=%' OR post_content LIKE '%<script%' OR post_content LIKE '%javascript:%');"