THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-84022 (MEDIUM 6.8) — The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected

[NVD] CVE-2026-84022 (MEDIUM 6.8) — The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected

mednvdPublished 2026-09-05

CVE-2026-84022 CVSS: 6.8 MEDIUM Published: 2026-09-05T07:17:13.573

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.

Indicators of compromise

CVE-2026-84022cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-84022