BoldThemes vulnerabilities

CVEs per yearBy the year they were published

1. 20213
2. 20231
3. 202419
4. 202519
5. 202621

Newest CVEs

• CVE-2026-62077

  WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability

  BoldThemes · Avala

  Critical9.8
• CVE-2026-6173

  Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter

  boldthemes · Bold Page Builder

  Medium6.4
• CVE-2026-6170

  Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute

  boldthemes · Bold Page Builder

  Medium6.4
• CVE-2026-6171

  Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute

  boldthemes · Bold Page Builder

  Medium6.4
• CVE-2026-88037

  Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title

  boldthemes · Bold Page Builder

  Medium6.4
• CVE-2026-6172

  Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter

  boldthemes · Bold Page Builder

  Medium6.4
• CVE-2026-5920

  Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter

  boldthemes · Bold Page Builder

  Medium6.4
• CVE-2026-62110

  WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability

  boldthemes · Bold Page Builder

  Medium6.5
• CVE-2026-7438

  Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

  boldthemes · Bold Timeline Lite

  Medium6.4
• CVE-2026-2357

  Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting

  boldthemes · Bold Page Builder

  Medium6.4