Boldthemes vulnerabilities
63 CVEs and advisories name Boldthemes as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-62077WordPress Avala theme <= 1.1.4 - PHP Object Injection vulnerability
- CVE-2026-6173Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter
- CVE-2026-6170Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute
- CVE-2026-6171Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
- CVE-2026-88037Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title
- CVE-2026-6172Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter
- CVE-2026-5920Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter
- CVE-2026-62110WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-7438Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- CVE-2026-2357Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2026-27429WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability
- CVE-2026-3694Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode
- CVE-2026-27369WordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerability
- CVE-2025-68541WordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerability
- CVE-2025-67997WordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerability
- CVE-2025-67996WordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerability
- CVE-2026-25451WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-12159Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2025-13463Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid
- CVE-2025-12803Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode
- CVE-2025-15267Bold Page Builder <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode
- CVE-2025-68513WordPress Bold Timeline Lite plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-64233WordPress Codiqa theme < 1.2.8 - PHP Object Injection vulnerability
- CVE-2025-54723WordPress DentiCare Theme < 1.4.3 - PHP Object Injection Vulnerability
- CVE-2025-14032Bold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold_timeline_group' Shortcode
- CVE-2025-66057WordPress Bold Page Builder plugin <= 5.5.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2025-7730Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter
- CVE-2025-60216WordPress Addison theme < 1.4.8 - PHP Object Injection vulnerability
- CVE-2025-60214WordPress Goldenblatt theme < 1.3.0 - PHP Object Injection vulnerability
- CVE-2025-58194WordPress Bold Page Builder Plugin <= 5.4.3 - Cross Site Scripting (XSS) Vulnerability