Plugin security history

Bold Page Builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 35 vulnerability records associated with Bold Page Builder, published between 2019 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

35Total records

0Critical

2High

32Medium

1Low

0Informational

31Patched records

4Currently marked unpatched

2019-08-23First disclosure

2026-05-13Latest disclosure

35 of 35CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2019	1	1 records
2021	1	1 records
2022	1	1 records
2023	1	1 records
2024	16	16 records
2025	9	9 records
2026	6	6 records

Severity Breakdown

Severity	Records	Share
High	2	5.7%
Medium	32	91.4%
Low	1	2.9%

Vulnerability-Type Breakdown

Cross-Site Scripting

31 records88.6%

First: 2022. Latest: 2026.

Missing Authorization

2 records5.7%

First: 2019. Latest: 2024.

Other

1 record2.9%

First: 2021. Latest: 2021.

Path Traversal

1 record2.9%

First: 2024. Latest: 2024.

Patch Status

Patched: 31
Currently marked unpatched: 4
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

5.6.9
5.7.0
5.5.3
5.4.6
5.4.4
5.4.2
5.1.3
5.3.7
5.3.6
5.3.1
5.3.3
5.1.6
5.2.2
5.1.4
5.1.1
5.1.2
5.0.3
4.8.9
4.7.7
4.8.1
4.7.0
4.3.3
3.1.6
2.3.2

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-5.6.8`	Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode	May 13, 2026	5.6.9	Medium
`*-5.4.8`	Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	February 6, 2026	Not supplied	Medium
`*-5.5.3`	Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid	February 6, 2026	Not supplied	Medium
`*-5.5.1`	Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode	February 6, 2026	Not supplied	Medium
`*-5.5.7`	Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode	February 6, 2026	Not supplied	Medium
`*-5.6.9`	Bold Page Builder <= 5.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting	January 20, 2026	5.7.0	Medium
`*-5.5.2`	Bold Page Builder <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	November 27, 2025	5.5.3	Medium
`*-5.4.5`	Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter	October 23, 2025	5.4.6	Medium
`*-5.4.3`	Bold Page Builder <= 5.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting	August 27, 2025	5.4.4	Medium
`*-5.4.1`	Bold Page Builder <= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	July 16, 2025	5.4.2	Medium
`*-5.1.2`	Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library	July 2, 2025	5.1.3	Medium
`*-5.3.6`	Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter	May 28, 2025	5.3.7	Medium
`*-5.3.5`	Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter	May 17, 2025	5.3.6	Medium
`*-5.3.0`	Bold Page Builder <= 5.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting	May 7, 2025	5.3.1	Medium
`*-5.3.2`	Bold Page Builder <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting	May 7, 2025	5.3.3	Medium
`*-5.1.5`	Bold Page Builder <= 5.1.5 - Authenticated (Editor+) Path Traversal	December 11, 2024	5.1.6	Low
`*-5.2.1`	Bold Page Builder <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	December 2, 2024	5.2.2	Medium
`*-5.1.3`	Bold Page Builder <= 5.1.3 - Missing Authorization	October 24, 2024	5.1.4	Medium
`*-5.1.0`	Bold Page Builder <= 5.1.- - Authenticated (Contributor+) Stored Cross-Site Scripting	September 30, 2024	5.1.1	Medium
`*-5.1.1`	Bold Page Builder <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting	September 24, 2024	5.1.2	Medium
`*-5.0.2`	Bold Page Builder <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode	July 29, 2024	5.0.3	Medium
`*-4.8.8`	Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags	April 9, 2024	4.8.9	Medium
`*-4.8.8`	Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via "Price List" Element	April 9, 2024	4.8.9	Medium
`*-4.8.8`	Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via AI Features	April 9, 2024	4.8.9	Medium
`*-4.8.8`	Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Separator Element	April 9, 2024	4.8.9	Medium

Selected source records

Latest Records

MediumCVE-2026-3694

Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode

Published: May 13, 2026

Affected versions: *-5.6.8
Patched versions: 5.6.9

Original Wordfence record

MediumCVE-2025-12159

Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: February 6, 2026

Affected versions: *-5.4.8
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-13463

Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid

Published: February 6, 2026

Affected versions: *-5.5.3
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-12803

Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode

Published: February 6, 2026

Affected versions: *-5.5.1
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-15267

Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode

Published: February 6, 2026

Affected versions: *-5.5.7
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2026-25451

Bold Page Builder <= 5.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: January 20, 2026

Affected versions: *-5.6.9
Patched versions: 5.7.0

Original Wordfence record

MediumCVE-2025-66057

Bold Page Builder <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: November 27, 2025

Affected versions: *-5.5.2
Patched versions: 5.5.3

Original Wordfence record

MediumCVE-2025-7730

Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter

Published: October 23, 2025

Affected versions: *-5.4.5
Patched versions: 5.4.6

Original Wordfence record

Highest-Severity Records

HighCVE-2021-24579

Bold Page Builder <= 3.1.5 - PHP Object Injection

Published: August 2, 2021

Affected versions: *-3.1.5
Patched versions: 3.1.6

Original Wordfence record

HighCVE-2019-15821

Bold Page Builder <= 2.3.1 - Missing Authorization to Settings Update

Published: August 23, 2019

Affected versions: *-2.3.1
Patched versions: 2.3.2

Original Wordfence record

MediumCVE-2024-3266

Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute

Published: April 5, 2024

Affected versions: *-4.8.8
Patched versions: 4.8.9

Original Wordfence record

MediumCVE-2025-15267

Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode

Published: February 6, 2026

Affected versions: *-5.5.7
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2024-30179

Bold Page Builder <= 4.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via class

Published: March 25, 2024

Affected versions: *-4.7.6
Patched versions: 4.7.7

Original Wordfence record

MediumCVE-2024-53801

Bold Page Builder <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: December 2, 2024

Affected versions: *-5.2.1
Patched versions: 5.2.2

Original Wordfence record

MediumCVE-2024-7100

Bold Page Builder <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode

Published: July 29, 2024

Affected versions: *-5.0.2
Patched versions: 5.0.3

Original Wordfence record

MediumCVE-2025-47488

Bold Page Builder <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: May 7, 2025

Affected versions: *-5.3.2
Patched versions: 5.3.3

Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2025-12159

Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: February 6, 2026

Affected versions: *-5.4.8
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-13463

Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid

Published: February 6, 2026

Affected versions: *-5.5.3
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-12803

Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode

Published: February 6, 2026

Affected versions: *-5.5.1
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2025-15267

Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode

Published: February 6, 2026

Affected versions: *-5.5.7
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory