boldthemes vulnerabilities

Products

• Bold Page Builder 41
• Bold Timeline Lite 5
• Bello - Directory & Listing 3
• Addison 1
• Amwerk 1
• Avala 1
• Avantage 1
• Celeste 1
• Codiqa 1
• DentiCare 1
• Goldenblatt 1
• Ippsum 1
• Medicare 1
• Nestin 1
• Nifty 1
• ReConstruction 1
• Travelicious 1

Latest boldthemes CVEs

Newest publication first · page 1 of 3

1. CVE-2026-62077 WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability

   Published 2026-10-10

   Critical·CVSS 9.8 EPSS 0.38%

   Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

2. CVE-2026-6173 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter

   Published 2026-09-30

   Medium·CVSS 6.4 EPSS 0.15%

   The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_image' parameter of the plugin's bt_bb_section shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supp...

3. CVE-2026-6171 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute

   Published 2026-09-30

   Medium·CVSS 6.4 EPSS 0.15%

   The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt_bb_icon shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attribut...

4. CVE-2026-6170 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute

   Published 2026-09-30

   Medium·CVSS 6.4 EPSS 0.15%

   The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt_bb_css_image_grid shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplie...

5. CVE-2026-6172 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter

   Published 2026-09-30

   Medium·CVSS 6.4 EPSS 0.15%

   The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt_bb_image shortcode in all versions up to, and including, 5.7.2 due to insufficient input sanitization and output escaping on user-supplied attrib...

6. CVE-2026-88037 Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title

   Published 2026-09-30

   Medium·CVSS 6.4 EPSS 0.15%

   The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title attribute of the bt_bb_service shortcode in all versions up to, and including, 5.7.2. This is due to insufficient input sanitization and output escaping on user supplied attribut...

7. CVE-2026-5920 Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter

   Published 2026-09-16

   Medium·CVSS 6.4 EPSS 0.28%

   The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' parameter of the bt_bb_shortcode shortcode in all versions up to, and including, 5.9.6. This is due to a bypassable security filter (bt_bb_save_pre) that can be cir...

8. CVE-2026-62110 WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability

   Published 2026-09-11

   Medium·CVSS 6.5 EPSS 0.22%

   Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.

9. CVE-2026-7438 Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

   Published 2026-09-11

   Medium·CVSS 6.4 EPSS 0.36%

   The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the supertitle and subtitle attributes of the bold_timeline_item shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user s...

10. CVE-2026-2357 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Published 2026-08-16

    Medium·CVSS 6.4 EPSS 0.32%

    The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt_bb_shortcode' shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it p...

11. CVE-2026-27429 WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability

    Published 2026-06-16

    Critical·CVSS 9.8 EPSS 0.56%

    Unauthenticated PHP Object Injection in Nifty <= 1.4.1 versions.

12. CVE-2026-3694 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode

    Published 2026-05-14

    Medium·CVSS 6.4 EPSS 0.16%

    The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the bt_bb_button shortcode in all versions up to, and including, 5.6.8. This is due to insufficient input sanitization and output escaping on user supplied attribut...

13. CVE-2026-27369 WordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerability

    Published 2026-03-05

    High·CVSS 8.1 EPSS 0.37%

    Deserialization of Untrusted Data vulnerability in BoldThemes Celeste celeste allows Object Injection.This issue affects Celeste: from n/a through <= 1.3.6.

14. CVE-2025-68541 WordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerability

    Published 2026-02-20

    Critical·CVSS 9.8 EPSS 0.45%

    Deserialization of Untrusted Data vulnerability in BoldThemes Ippsum ippsum allows Object Injection.This issue affects Ippsum: from n/a through <= 1.2.0.

15. CVE-2025-67997 WordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerability

    Published 2026-02-20

    Critical·CVSS 9.8 EPSS 0.45%

    Deserialization of Untrusted Data vulnerability in BoldThemes Travelicious travelicious allows Object Injection.This issue affects Travelicious: from n/a through < 1.6.7.

16. CVE-2025-67996 WordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerability

    Published 2026-02-20

    Critical·CVSS 9.8 EPSS 0.45%

    Deserialization of Untrusted Data vulnerability in BoldThemes Nestin nestin allows Object Injection.This issue affects Nestin: from n/a through < 1.2.6.

17. CVE-2026-25451 WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerability

    Published 2026-02-19

    Medium·CVSS 6.5 EPSS 0.19%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.6.9.

18. CVE-2025-13463 Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid

    Published 2026-02-07

    Medium·CVSS 6.4 EPSS 0.27%

    The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Grid component in all versions up to, and including, 5.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Aut...

19. CVE-2025-12159 Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    Published 2026-02-07

    Medium·CVSS 6.4 EPSS 0.23%

    The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_raw_content shortcode in all versions up to, and including, 5.4.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it p...

20. CVE-2025-12803 Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode

    Published 2026-02-07

    Medium·CVSS 6.4 EPSS 0.27%

    The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'bt_bb_tabs' shortcode in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

21. CVE-2025-15267 Bold Page Builder <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode

    Published 2026-02-07

    Medium·CVSS 6.4 EPSS 0.27%

    The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_accordion_item shortcode in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

22. CVE-2025-68513 WordPress Bold Timeline Lite plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

    Published 2025-12-24

    Medium·CVSS 6.5 EPSS 0.16%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Timeline Lite bold-timeline-lite allows Stored XSS.This issue affects Bold Timeline Lite: from n/a through <= 1.2.7.

23. CVE-2025-64233 WordPress Codiqa theme < 1.2.8 - PHP Object Injection vulnerability

    Published 2025-12-18

    Critical·CVSS 9.8 EPSS 0.38%

    Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8.

24. CVE-2025-54723 WordPress DentiCare Theme < 1.4.3 - PHP Object Injection Vulnerability

    Published 2025-12-18

    Critical·CVSS 9.8 EPSS 0.46%

    Deserialization of Untrusted Data vulnerability in BoldThemes DentiCare denticare allows Object Injection.This issue affects DentiCare: from n/a through < 1.4.3.

25. CVE-2025-14032 Bold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold_timeline_group' Shortcode

    Published 2025-12-12

    Medium·CVSS 6.4 EPSS 0.30%

    The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in the 'bold_timeline_group' shortcode in all versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.