Bold Page Builder

boldthemes

Developer

5.7.0

Latest version

50,000

Installations

No date

Last updated

WordPress Plugin

Active VDP

Report vulnerability

Vulnerabilities

Security Policy

Security Contributors

Vulnerability history

4 present

30 patched

3 Mitigation rules

Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability
<= 5.4.8
Feb 6, 2026
Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid vulnerability
<= 5.5.3
Feb 6, 2026
Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode vulnerability
<= 5.5.7
Feb 6, 2026
Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode vulnerability
<= 5.5.1
Feb 6, 2026
Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute vulnerability
<= 4.8.8
Feb 2, 2026
Cross Site Scripting (XSS) vulnerability
<= 5.6.9
Jan 20, 2026
Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library vulnerability
<= 5.1.2
Dec 31, 2025
Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter vulnerability
<= 5.3.5
Dec 31, 2025
Cross Site Scripting (XSS) vulnerability
<= 5.5.2
Nov 27, 2025
Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter vulnerability
<= 5.4.5
Oct 23, 2025
Cross Site Scripting (XSS) Vulnerability
<= 5.4.3
Aug 27, 2025
Cross Site Scripting (XSS) Vulnerability
<= 5.4.1
Jul 16, 2025
Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter vulnerability
<= 5.3.6
May 28, 2025
Cross Site Scripting (XSS) Vulnerability
<= 5.3.0
May 7, 2025
Cross Site Scripting (XSS) Vulnerability
<= 5.3.2
May 7, 2025
Path Traversal vulnerability
<= 5.1.5
Dec 11, 2024
Cross Site Scripting (XSS) vulnerability
<= 5.2.1
Dec 2, 2024
Broken Access Control vulnerability
<= 5.1.3
Oct 24, 2024
Cross Site Scripting (XSS) vulnerability
< 5.1.1
Sep 30, 2024
Cross Site Scripting (XSS) vulnerability
<= 5.1.1
Sep 24, 2024
Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode vulnerability
<= 5.0.2
Jul 30, 2024
Authenticated Stored Cross-Site Scripting vulnerability
<= 4.8.8
Apr 11, 2024
Authenticated Stored Cross-Site Scripting vulnerability
<= 4.8.8
Apr 11, 2024
Authenticated Stored Cross-Site Scripting vulnerability
<= 4.8.8
Apr 11, 2024
Authenticated Stored Cross-Site Scripting vulnerability
<= 4.8.8
Apr 11, 2024
Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode vulnerability
<= 4.8.8
Apr 8, 2024
Cross Site Scripting (XSS) vulnerability
<= 4.8.0
Mar 28, 2024
Cross Site Scripting (XSS) vulnerability
<= 4.7.6
Mar 25, 2024
Authenticated (Contributor+) Stored Cross-Site Scripting via Raw Content vulnerability
<= 4.8.0
Feb 14, 2024
Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Link vulnerability
<= 4.8.0
Feb 13, 2024
Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL vulnerability
<= 4.8.0
Feb 13, 2024
Cross Site Scripting (XSS) vulnerability
<= 4.6.1
Dec 5, 2023
Authenticated Stored Cross-Site Scripting (XSS) vulnerability
<= 4.3.2
Jun 20, 2022
PHP Object Injection vulnerability
<= 3.1.5
Aug 2, 2021