What is GHSA-5q9q-vpgg-v6hg?

GHSA-5q9q-vpgg-v6hg is a security advisory published by GitHub Security Advisories with Medium severity. The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several...

Which CVE IDs does GHSA-5q9q-vpgg-v6hg cover?

GHSA-5q9q-vpgg-v6hg covers the following CVE IDs: CVE-2026-84022. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5q9q-vpgg-v6hg?

GHSA-5q9q-vpgg-v6hg has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-5q9q-vpgg-v6hgMediumCVSS 6.8

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several...

Vendor

GitHub Security Advisories

Published

September 5, 2026

Last Modified

September 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-84022 →

📋 Description

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-84022
https://wpscan.com/vulnerability/53bbe80c-caea-4893-82a6-03e5173390de
https://github.com/advisories/GHSA-5q9q-vpgg-v6hg