Unknown Bold Page Builder vulnerabilities

3 CVEs affecting Unknown Bold Page Builder, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-84028, published 2026-09-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-84028, published 2026-09-06. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to…
CVE-2026-84022, published 2026-09-05. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and…
CVE-2026-84021, published 2026-09-05. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the…