WordPress bold-page-builder has 13 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2019-15821 | The bold-page-builder plugin before 2.3.2 for WordPress has no protection against modifying settings and importing data. | high | 7.5 | <2.3.2 | 2.3.2 |
| CVE-2021-24579 | The bt_bb_get_grid AJAX action of the Bold Page Builder WordPress plugin before 3.1.6 passes user input into the unserialize() function with | high | 8.8 | <3.1.6 | 3.1.6 |
| CVE-2022-2089 | The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow high privilege user | medium | 4.8 | <4.3.3 | 4.3.3 |
| CVE-2024-2734 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's AI features all versions up to, and | medium | 6.4 | <4.8.9 | 4.8.9 |
| CVE-2024-2735 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Price List' element in all versions up to, | medium | 6.4 | <4.8.9 | 4.8.9 |
| CVE-2024-2736 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML Tags in all versions up to, and including, | medium | 6.4 | <4.8.9 | 4.8.9 |
| CVE-2024-2733 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's "Separator" element in all versions | medium | 5.4 | <4.8.9 | 4.8.9 |
| CVE-2024-7100 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_button shortcode in all versi | medium | 6.4 | <5.0.3 | 5.0.3 |
| CVE-2024-3266 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of widgets in all versions up | medium | 6.4 | <4.8.9 | 4.8.9 |
| CVE-2024-3267 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_price_list shortcode in all v | medium | 6.4 | <4.8.9 | 4.8.9 |
| CVE-2024-1157 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's button URL in all versions up to, a | medium | 5.4 | <4.8.1 | 4.8.1 |
| CVE-2024-1159 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, | medium | 6.4 | <4.8.1 | 4.8.1 |
| CVE-2024-1160 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Link in all versions up to, an | medium | 5.4 | <4.8.1 | 4.8.1 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked