Unknown Bold Page Builder vulnerabilities
5 vulnerabilities
Known vulnerabilities in Unknown Bold Page Builder, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-24579bold-themesbold_page_builder+2
EPSS score8.21%
The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function without any validation or sanitisation, which could lead to a PHP Object Injection. Even though the plugin did not contain a suitable gadget to fully exploit the issue, other installed plugins on the blog could allow such issue to be exploited and lead to RCE in some cases.CVE-2022-2089bold-themesbold_page_builder+2EPSS score1.11%
The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.CVE-2026-84028unknownbold page builder+1EPSS score0.43%
The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.CVE-2026-84021unknownbold page builder+1EPSS score0.43%
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.CVE-2026-84022unknownbold page builder+1EPSS score0.43%
The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.