VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 34 known issues Latest disclosed Feb 06, 2026

Bold Page Builder Vulnerabilities

Review known vulnerability records for the WordPress plugin Bold Page Builder (`bold-page-builder`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-12159, CVE-2025-13463 and CVE-2025-12803, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
34
High or Critical
2
Patch Coverage
100%
Last Updated
Apr 15, 2026
Priority CVE Quick Links

Fast paths into Bold Page Builder CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
34
CVE-2021-24579 High 3.1.6
CVE-2021-24579 Bold Page Builder Vulnerability

Bold Page Builder <= 3.1.5 - PHP Object Injection

CVE-2019-15821 High 2.3.2
CVE-2019-15821 Bold Page Builder Vulnerability

Bold Page Builder <= 2.3.1 - Missing Authorization to Settings Update

CVE-2025-12159 Medium No patch listed
CVE-2025-12159 Bold Page Builder Stored Cross-Site Scripting

Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

CVE-2025-13463 Medium No patch listed
CVE-2025-13463 Bold Page Builder Stored Cross-Site Scripting

Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid

CVE-2025-12803 Medium No patch listed
CVE-2025-12803 Bold Page Builder Stored Cross-Site Scripting

Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode

CVE-2025-15267 Medium No patch listed
CVE-2025-15267 Bold Page Builder Stored Cross-Site Scripting

Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode

CVE-2026-25451 Medium 5.7.0
CVE-2026-25451 Bold Page Builder Stored Cross-Site Scripting

Bold Page Builder <= 5.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

CVE-2025-66057 Medium 5.5.3
CVE-2025-66057 Bold Page Builder Stored Cross-Site Scripting

Bold Page Builder <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Bold Page Builder so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
34 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 2 high severity findings.
Recent CVEs
CVE-2025-12159, CVE-2025-13463 and CVE-2025-12803
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Bold Page Builder

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: No CVE-2025-12159
CVE-2025-12159: Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_raw_content shortcode in all versions up to, and including, 5.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it p...

Published
Feb 06, 2026
Patched Release
Not published
Affected Versions
Versions up to 5.4.8
Next Step
Open the full report for remediation notes and references.
Open CVE-2025-12159 Report Open CVE Reference
Plugin Medium Patched: No CVE-2025-13463
CVE-2025-13463: Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Grid component in all versions up to, and including, 5.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Aut...

Published
Feb 06, 2026
Patched Release
Not published
Affected Versions
Versions up to 5.5.3
Next Step
Open the full report for remediation notes and references.
Open CVE-2025-13463 Report Open CVE Reference
Plugin Medium Patched: No CVE-2025-12803
CVE-2025-12803: Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'bt_bb_tabs' shortcode in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

Published
Feb 06, 2026
Patched Release
Not published
Affected Versions
Versions up to 5.5.1
Next Step
Open the full report for remediation notes and references.
Open CVE-2025-12803 Report Open CVE Reference
Plugin Medium Patched: No CVE-2025-15267
CVE-2025-15267: Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_accordion_item shortcode in all versions up to, and including, 5.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

Published
Feb 06, 2026
Patched Release
Not published
Affected Versions
Versions up to 5.5.7
Next Step
Open the full report for remediation notes and references.
Open CVE-2025-15267 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-25451
CVE-2026-25451: Bold Page Builder <= 5.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

Published
Jan 20, 2026
Patched Release
5.7.0
Affected Versions
Versions up to 5.6.9
Next Step
Update to 5.7.0 or newer if supported.
Open CVE-2026-25451 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-66057
CVE-2025-66057: Bold Page Builder <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

Published
Nov 27, 2025
Patched Release
5.5.3
Affected Versions
Versions up to 5.5.2
Next Step
Update to 5.5.3 or newer if supported.
Open CVE-2025-66057 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-7730
CVE-2025-7730: Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘percentage’ parameter in all versions up to, and including, 5.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Published
Oct 23, 2025
Patched Release
5.4.6
Affected Versions
Versions up to 5.4.5
Next Step
Update to 5.4.6 or newer if supported.
Open CVE-2025-7730 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-58194
CVE-2025-58194: Bold Page Builder <= 5.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

Published
Aug 27, 2025
Patched Release
5.4.4
Affected Versions
Versions up to 5.4.3
Next Step
Update to 5.4.4 or newer if supported.
Open CVE-2025-58194 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-54006
CVE-2025-54006: Bold Page Builder <= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

Published
Jul 16, 2025
Patched Release
5.4.2
Affected Versions
Versions up to 5.4.1
Next Step
Update to 5.4.2 or newer if supported.
Open CVE-2025-54006 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-5647
CVE-2024-5647: Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for aut...

Published
Jul 02, 2025
Patched Release
5.1.3
Affected Versions
Versions up to 5.1.2
Next Step
Update to 5.1.3 or newer if supported.
Open CVE-2024-5647 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-5286
CVE-2025-5286: Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘additional_settings’ parameter in all versions up to, and including, 5.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...

Published
May 28, 2025
Patched Release
5.3.7
Affected Versions
Versions up to 5.3.6
Next Step
Update to 5.3.7 or newer if supported.
Open CVE-2025-5286 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-3715
CVE-2025-3715: Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text parameter in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Con...

Published
May 17, 2025
Patched Release
5.3.6
Affected Versions
Versions up to 5.3.5
Next Step
Update to 5.3.6 or newer if supported.
Open CVE-2025-3715 Report Open CVE Reference