Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

BoldThemes — Vulnerabilities & Security Advisories 54

Browse all 54 CVE security advisories affecting BoldThemes. AI-powered Chinese analysis, POCs, and references for each vulnerability.

BoldThemes operates as a prominent developer of premium WordPress themes and plugins, primarily targeting business and portfolio websites. Its extensive product portfolio has historically exposed users to significant security risks, resulting in fifty recorded Common Vulnerabilities and Exposures. The most prevalent vulnerability classes include Remote Code Execution, Cross-Site Scripting, and Privilege Escalation, often stemming from insufficient input validation and weak authentication mechanisms in older plugin versions. While the company has implemented security patches for identified flaws, the sheer volume of past incidents highlights systemic challenges in maintaining code integrity across a large, diverse suite of products. Users are advised to prioritize regular updates and rigorous security auditing to mitigate the inherent risks associated with these widely deployed WordPress extensions.

CVE ID Title CVSS Severity Published
CVE-2026-7438 Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes — Bold Timeline Lite CWE-79 6.4 Medium 2026-09-11
CVE-2026-2357 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting — Bold Page Builder CWE-79 6.4 Medium 2026-08-16
CVE-2026-27429 WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability — Nifty CWE-502 9.8 Critical 2026-06-16
CVE-2026-3694 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode — Bold Page Builder CWE-79 6.4 Medium 2026-05-14
CVE-2026-27369 WordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerability — Celeste CWE-502 8.1 High 2026-03-05
CVE-2025-68541 WordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerability — Ippsum CWE-502 9.8 Critical 2026-02-20
CVE-2025-67997 WordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerability — Travelicious CWE-502 9.8 Critical 2026-02-20
CVE-2025-67996 WordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerability — Nestin CWE-502 9.8 Critical 2026-02-20
CVE-2026-25451 WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerability — Bold Page Builder CWE-79 6.5 Medium 2026-02-19
CVE-2025-12159 Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode — Bold Page Builder CWE-79 6.4 Medium 2026-02-07
CVE-2025-13463 Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid — Bold Page Builder CWE-79 6.4 Medium 2026-02-07
CVE-2025-12803 Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode — Bold Page Builder CWE-80 6.4 Medium 2026-02-07
CVE-2025-15267 Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode — Bold Page Builder CWE-79 6.4 Medium 2026-02-07
CVE-2025-68513 WordPress Bold Timeline Lite plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability — Bold Timeline Lite CWE-79 6.5 Medium 2025-12-24
CVE-2025-64233 WordPress Codiqa theme < 1.2.8 - PHP Object Injection vulnerability — Codiqa CWE-502 9.8 Critical 2025-12-18
CVE-2025-54723 WordPress DentiCare Theme < 1.4.3 - PHP Object Injection Vulnerability — DentiCare CWE-502 9.8 Critical 2025-12-18
CVE-2025-14032 Bold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold_timeline_group' Shortcode — Bold Timeline Lite CWE-79 6.4 Medium 2025-12-12
CVE-2025-66057 WordPress Bold Page Builder plugin <= 5.5.2 - Cross Site Scripting (XSS) vulnerability — Bold Page Builder CWE-79 6.5 Medium 2025-11-21
CVE-2025-7730 Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter — Bold Page Builder CWE-79 6.4 Medium 2025-10-23
CVE-2025-60216 WordPress Addison theme < 1.4.8 - PHP Object Injection vulnerability — Addison CWE-502 9.8 Critical 2025-10-22
CVE-2025-60214 WordPress Goldenblatt theme < 1.3.0 - PHP Object Injection vulnerability — Goldenblatt CWE-502 9.8 Critical 2025-10-22
CVE-2025-58194 WordPress Bold Page Builder Plugin <= 5.4.3 - Cross Site Scripting (XSS) Vulnerability — Bold Page Builder CWE-79 6.5 Medium 2025-08-27
CVE-2025-54006 WordPress Bold Page Builder plugin <= 5.4.1 - Cross Site Scripting (XSS) Vulnerability — Bold Page Builder CWE-79 6.5 Medium 2025-07-16
CVE-2025-52724 WordPress Amwerk theme <= 1.2.0 - PHP Object Injection Vulnerability — Amwerk CWE-502 9.8 Critical 2025-06-27
CVE-2025-5286 Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter — Bold Page Builder CWE-79 6.4 Medium 2025-05-29
CVE-2025-39495 WordPress Avantage Theme <= 2.4.9 - PHP Object Injection vulnerability — Avantage CWE-502 9.8 Critical 2025-05-23
CVE-2025-39499 WordPress Medicare Theme <= 2.1.0 - PHP Object Injection vulnerability — Medicare CWE-502 9.8 Critical 2025-05-23
CVE-2025-3715 Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter — Bold Page Builder CWE-79 6.4 Medium 2025-05-18
CVE-2025-47525 WordPress Bold Page Builder plugin <= 5.3.0 - Cross Site Scripting (XSS) Vulnerability — Bold Page Builder CWE-79 5.9 Medium 2025-05-07
CVE-2025-47488 WordPress Bold Page Builder plugin <= 5.3.2 - Cross Site Scripting (XSS) Vulnerability — Bold Page Builder CWE-79 6.5 Medium 2025-05-07

This page lists every published CVE security advisory associated with BoldThemes. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.