VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 35 known issues Latest disclosed May 13, 2026

Bold Page Builder Vulnerabilities

Review known vulnerability records for the WordPress plugin Bold Page Builder (`bold-page-builder`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2026-3694, CVE-2025-12159 and CVE-2025-13463, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
35
High or Critical
2
Patch Coverage
100%
Last Updated
May 20, 2026
Related Security Guides

Use these guides while reviewing Bold Page Builder fixes

Pair this plugin vulnerability hub with practical WordPress hardening, scanner, and patch workflow guidance.

Hardening
WordPress hardening checklist for exposed plugins

Review patch cadence, privileged access, XML-RPC exposure, backups, and monitoring controls.
Plugin Security
WordPress plugin security basics for patch decisions

Use ownership, update testing, least privilege, and removal criteria to reduce plugin risk.
Scanning
WordPress vulnerability scanner buyer's guide

Compare scanner coverage for plugin CVEs, version detection, alert noise, and remediation workflow.
Patch Decision Workflow

How to prioritize Bold Page Builder remediation

Use the hub as a decision layer before opening individual records: confirm whether the issue has a CVE, whether a fixed version exists, and whether the affected range overlaps production installs.

Search-Ready Records
35
1. Match the Package
Confirm the installed WordPress plugin slug is bold-page-builder before acting on any CVE from this cluster.
2. Sort by Severity
Start with 2 high or critical records, then review medium and unrated findings with public references.
3. Check Patch Evidence
35 records include a patch path; verify compatibility before closing the finding.
4. Monitor Gaps
0 records still lack a listed fixed release, so keep this hub in the review queue.
High-Signal Remediation Targets
CVE-2021-24579 High
Vulnerability remediation for Bold Page Builder

Affected range: Versions up to 3.1.5. Fixed version: 3.1.6.

CVE-2019-15821 High
Vulnerability remediation for Bold Page Builder

Affected range: Versions up to 2.3.1. Fixed version: 2.3.2.

CVE-2026-3694 Medium
Stored Cross-Site Scripting remediation for Bold Page Builder

Affected range: Versions up to 5.6.8. Fixed version: 5.6.9.

CVE-2025-12159 Medium
Stored Cross-Site Scripting remediation for Bold Page Builder

Affected range: Versions up to 5.4.8. Fixed version is not listed yet.

Priority CVE Quick Links

Fast paths into Bold Page Builder CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
35
Tracked CVE Issue Type Affected Versions Fixed Version CVSS
CVE-2021-24579
Bold Page Builder <= 3.1.5 - PHP Object Injection
 Vulnerability Versions up to 3.1.5 3.1.6 CVSS 7.5
CVE-2019-15821
Bold Page Builder <= 2.3.1 - Missing Authorization to Settings Update
 Vulnerability Versions up to 2.3.1 2.3.2 CVSS 7.5
CVE-2026-3694
Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scriptin...
 Stored Cross-Site Scripting Versions up to 5.6.8 5.6.9 CVSS 6.4
CVE-2025-12159
Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scriptin...
 Stored Cross-Site Scripting Versions up to 5.4.8 No patch listed CVSS 6.4
CVE-2025-13463
Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scr...
 Stored Cross-Site Scripting Versions up to 5.5.3 No patch listed CVSS 6.4
CVE-2025-12803
Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via...
 Stored Cross-Site Scripting Versions up to 5.5.1 No patch listed CVSS 6.4
CVE-2025-15267
Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scriptin...
 Stored Cross-Site Scripting Versions up to 5.5.7 No patch listed CVSS 6.4
CVE-2026-25451
Bold Page Builder <= 5.6.9 - Authenticated (Contributor+) Stored Cross-Site Scriptin...
 Stored Cross-Site Scripting Versions up to 5.6.9 5.7.0 CVSS 6.4
CVE-2021-24579 High 3.1.6
CVE-2021-24579 Bold Page Builder Vulnerability

Bold Page Builder <= 3.1.5 - PHP Object Injection

CVE-2019-15821 High 2.3.2
CVE-2019-15821 Bold Page Builder Vulnerability

Bold Page Builder <= 2.3.1 - Missing Authorization to Settings Update

CVE-2026-3694 Medium 5.6.9
CVE-2026-3694 Bold Page Builder Stored Cross-Site Scripting

Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode

CVE-2025-12159 Medium No patch listed
CVE-2025-12159 Bold Page Builder Stored Cross-Site Scripting

Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

CVE-2025-13463 Medium No patch listed
CVE-2025-13463 Bold Page Builder Stored Cross-Site Scripting

Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid

CVE-2025-12803 Medium No patch listed
CVE-2025-12803 Bold Page Builder Stored Cross-Site Scripting

Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode

CVE-2025-15267 Medium No patch listed
CVE-2025-15267 Bold Page Builder Stored Cross-Site Scripting

Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode

CVE-2026-25451 Medium 5.7.0
CVE-2026-25451 Bold Page Builder Stored Cross-Site Scripting

Bold Page Builder <= 5.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Coverage Snapshot

What this page helps you verify fast

This hub clusters tracked records for Bold Page Builder so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
35 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 2 high severity findings.
Recent CVEs
CVE-2026-3694, CVE-2025-12159 and CVE-2025-13463
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Bold Page Builder

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2026-3694
CVE-2026-3694: Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the bt_bb_button shortcode in all versions up to, and including, 5.6.8. This is due to insufficient input sanitization and output escaping on user supplied attribut...

Published
May 13, 2026
Patched Release
5.6.9
Affected Versions
Versions up to 5.6.8
Next Step
Update to 5.6.9 or newer if supported.
Review CVE-2026-3694 fixed version details Open CVE Reference
Plugin Medium Patched: No CVE-2025-12159
CVE-2025-12159: Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_raw_content shortcode in all versions up to, and including, 5.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it p...

Published
Feb 06, 2026
Patched Release
Not published
Affected Versions
Versions up to 5.4.8
Next Step
Open the full report for remediation notes and references.
Review CVE-2025-12159 fixed version details Open CVE Reference
Plugin Medium Patched: No CVE-2025-13463
CVE-2025-13463: Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Grid component in all versions up to, and including, 5.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Aut...

Published
Feb 06, 2026
Patched Release
Not published
Affected Versions
Versions up to 5.5.3
Next Step
Open the full report for remediation notes and references.
Review CVE-2025-13463 fixed version details Open CVE Reference
Plugin Medium Patched: No CVE-2025-12803
CVE-2025-12803: Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'bt_bb_tabs' shortcode in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

Published
Feb 06, 2026
Patched Release
Not published
Affected Versions
Versions up to 5.5.1
Next Step
Open the full report for remediation notes and references.
Review CVE-2025-12803 fixed version details Open CVE Reference
Plugin Medium Patched: No CVE-2025-15267
CVE-2025-15267: Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_accordion_item shortcode in all versions up to, and including, 5.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

Published
Feb 06, 2026
Patched Release
Not published
Affected Versions
Versions up to 5.5.7
Next Step
Open the full report for remediation notes and references.
Review CVE-2025-15267 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2026-25451
CVE-2026-25451: Bold Page Builder <= 5.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

Published
Jan 20, 2026
Patched Release
5.7.0
Affected Versions
Versions up to 5.6.9
Next Step
Update to 5.7.0 or newer if supported.
Review CVE-2026-25451 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-66057
CVE-2025-66057: Bold Page Builder <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

Published
Nov 27, 2025
Patched Release
5.5.3
Affected Versions
Versions up to 5.5.2
Next Step
Update to 5.5.3 or newer if supported.
Review CVE-2025-66057 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-7730
CVE-2025-7730: Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘percentage’ parameter in all versions up to, and including, 5.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Published
Oct 23, 2025
Patched Release
5.4.6
Affected Versions
Versions up to 5.4.5
Next Step
Update to 5.4.6 or newer if supported.
Review CVE-2025-7730 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-58194
CVE-2025-58194: Bold Page Builder <= 5.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

Published
Aug 27, 2025
Patched Release
5.4.4
Affected Versions
Versions up to 5.4.3
Next Step
Update to 5.4.4 or newer if supported.
Review CVE-2025-58194 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-54006
CVE-2025-54006: Bold Page Builder <= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above,...

Published
Jul 16, 2025
Patched Release
5.4.2
Affected Versions
Versions up to 5.4.1
Next Step
Update to 5.4.2 or newer if supported.
Review CVE-2025-54006 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-5647
CVE-2024-5647: Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled Magnific Popups library (version 1.1.0) in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for aut...

Published
Jul 02, 2025
Patched Release
5.1.3
Affected Versions
Versions up to 5.1.2
Next Step
Update to 5.1.3 or newer if supported.
Review CVE-2024-5647 fixed version details Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-5286
CVE-2025-5286: Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘additional_settings’ parameter in all versions up to, and including, 5.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...

Published
May 28, 2025
Patched Release
5.3.7
Affected Versions
Versions up to 5.3.6
Next Step
Update to 5.3.7 or newer if supported.
Review CVE-2025-5286 fixed version details Open CVE Reference