Bold Page Builder

Vulnerabilities 35Slug bold-page-builderLatest version 5.7.3WordPress.org →

Minimum safe version

5.7.0

Update to 5.7.0 or later to address 31 fixable vulnerabilities

Latest available5.7.3 ✓⚠ 4 vulnerabilities have no fix
Medium 6.4
2025-10-23< 5.4.6

Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter

WordfenceEUVDCVE
Medium 6.4 Unfixed
2026-02-07≤ 5.4.8

Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

CVEEUVDWordfence
Medium 6.4 Unfixed
2026-02-07≤ 5.5.1

Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode

CVEEUVDWordfence
Medium 6.4 Unfixed
2026-02-07≤ 5.5.3

Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid

CVEEUVDWordfence
Medium 6.4 Unfixed
2026-02-07≤ 5.5.7

Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode

CVEEUVDWordfence
Medium 6.5
2025-11-27< 5.5.3

Bold Page Builder <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

WordfenceCVE
Medium 6.4
2025-07-03< 5.1.3

Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library

EUVDWordfenceWPScanCVE
Medium 6.4
2025-05-28< 5.3.7

Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter

WordfenceCVE
Medium 6.4
2025-05-18< 5.3.6

Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter

EUVDWordfenceCVE