CVE-2026-84028— Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings
Quick assessment
Affected
Unknown Bold Page Builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
版本低于 5.9.9 的 Bold Page Builder WordPress 插件在将短代码属性输出到 HTML 属性时，未对其进行净化和转义处理，使得拥有“Contributor”（贡献者）角色或更高权限的用户能够注入任意 Web 脚本，这些脚本会在用户浏览受影响页面时执行。
Possible ATT&CK Techniques 3 AI
T1189 · Drive-by Compromise T1059.001 · PowerShell T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-84028
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings
Source: CVE Program / CVE List V5
Vulnerability Description
The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Bold Page Builder | 0 ~ 5.9.9 | - |
|
II. Public POCs for CVE-2026-84028
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-84028
请登录查看更多情报信息。
Proof of Concept for CVE-2026-84028 (1)
-
🔗 Bold Page Builder < 5.9.9 – Contributor+ Stored XSS via Slider Elements' additional_settings | CVE 2026-84028 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-06 · 6 CVEs total
| CVE-2026-85038 | B2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass via Registrati | |
| CVE-2026-84219 | Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding | |
| CVE-2026-75793 | SureCart < 4.7.0 - Unauthenticated Account Creation with Automatic Login | |
| CVE-2026-18480 | SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover | |
| CVE-2026-13159 | Real Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation |
IV. Related Vulnerabilities
Same product: Bold Page Builder
-
CVE-2026-84021
Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_b -
CVE-2026-84022
Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Mult -
CVE-2026-2357
Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) St -
CVE-2026-3694
Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) St -
CVE-2026-25451
WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scr
Same vendor: Unknown
-
CVE-2026-85038
B2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and -
CVE-2026-84219
Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML En -
CVE-2026-75793
SureCart < 4.7.0 - Unauthenticated Account Creation with Aut -
CVE-2026-18480
SureCart < 4.6.3 - Subscriber+ Administrator Account Takeove -
CVE-2026-13159
Real Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation
V. Comments for CVE-2026-84028
No comments yet