# cve.now: Boldthemes

The newest entries naming Boldthemes as an affected vendor (up to 200), of 63 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-62077](https://cve.now/CVE-2026-62077.md): WordPress Avala theme \<= 1.1.4 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-6173](https://cve.now/CVE-2026-6173.md): Bold Page Builder \<= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background\_image' Parameter (CVSS 6.4)
- [CVE-2026-6170](https://cve.now/CVE-2026-6170.md): Bold Page Builder \<= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt\_bb\_css\_image\_grid 'images' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-6171](https://cve.now/CVE-2026-6171.md): Bold Page Builder \<= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute (CVSS 6.4)
- [CVE-2026-88037](https://cve.now/CVE-2026-88037.md): Bold Page Builder \<= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt\_bb\_service title (CVSS 6.4)
- [CVE-2026-6172](https://cve.now/CVE-2026-6172.md): Bold Page Builder \<= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter (CVSS 6.4)
- [CVE-2026-5920](https://cve.now/CVE-2026-5920.md): Bold Page Builder \<= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode\_content' Parameter (CVSS 6.4)
- [CVE-2026-62110](https://cve.now/CVE-2026-62110.md): WordPress Bold Page Builder plugin \<= 5.9.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-7438](https://cve.now/CVE-2026-7438.md): Bold Timeline Lite \<= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
- [CVE-2026-2357](https://cve.now/CVE-2026-2357.md): Bold Page Builder \<= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2026-27429](https://cve.now/CVE-2026-27429.md): WordPress Nifty theme \<= 1.4.1 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-3694](https://cve.now/CVE-2026-3694.md): Bold Page Builder \<= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt\_bb\_button Shortcode (CVSS 6.4)
- [CVE-2026-27369](https://cve.now/CVE-2026-27369.md): WordPress Celeste theme \<= 1.3.6 - PHP Object Injection vulnerability (CVSS 8.1)
- [CVE-2025-68541](https://cve.now/CVE-2025-68541.md): WordPress Ippsum theme \<= 1.2.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-67997](https://cve.now/CVE-2025-67997.md): WordPress Travelicious theme \< 1.6.7 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-67996](https://cve.now/CVE-2025-67996.md): WordPress Nestin theme \< 1.2.6 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2026-25451](https://cve.now/CVE-2026-25451.md): WordPress Bold Page Builder plugin \<= 5.6.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-12159](https://cve.now/CVE-2025-12159.md): Bold Page Builder \<= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2025-13463](https://cve.now/CVE-2025-13463.md): Bold Page Builder \<= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid (CVSS 6.4)
- [CVE-2025-12803](https://cve.now/CVE-2025-12803.md): Bold Builder \<= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt\_bb\_tabs Shortcode (CVSS 6.4)
- [CVE-2025-15267](https://cve.now/CVE-2025-15267.md): Bold Page Builder \<= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt\_bb\_accordion\_item Shortcode (CVSS 6.4)
- [CVE-2025-68513](https://cve.now/CVE-2025-68513.md): WordPress Bold Timeline Lite plugin \<= 1.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-64233](https://cve.now/CVE-2025-64233.md): WordPress Codiqa theme \< 1.2.8 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-54723](https://cve.now/CVE-2025-54723.md): WordPress DentiCare Theme \< 1.4.3 - PHP Object Injection Vulnerability (CVSS 9.8)
- [CVE-2025-14032](https://cve.now/CVE-2025-14032.md): Bold Timeline Lite \<= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold\_timeline\_group' Shortcode (CVSS 6.4)
- [CVE-2025-66057](https://cve.now/CVE-2025-66057.md): WordPress Bold Page Builder plugin \<= 5.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2025-7730](https://cve.now/CVE-2025-7730.md): Bold Page Builder \<= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via \`percentage\` Parameter (CVSS 6.4)
- [CVE-2025-60216](https://cve.now/CVE-2025-60216.md): WordPress Addison theme \< 1.4.8 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-60214](https://cve.now/CVE-2025-60214.md): WordPress Goldenblatt theme \< 1.3.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-58194](https://cve.now/CVE-2025-58194.md): WordPress Bold Page Builder Plugin \<= 5.4.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2025-54006](https://cve.now/CVE-2025-54006.md): WordPress Bold Page Builder plugin \<= 5.4.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2024-5647](https://cve.now/CVE-2024-5647.md): Multiple Plugins \<= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library (CVSS 6.4)
- [CVE-2025-52724](https://cve.now/CVE-2025-52724.md): WordPress Amwerk theme \<= 1.2.0 - PHP Object Injection Vulnerability (CVSS 9.8)
- [CVE-2025-5286](https://cve.now/CVE-2025-5286.md): Bold Builder \<= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional\_settings Parameter (CVSS 6.4)
- [CVE-2025-39495](https://cve.now/CVE-2025-39495.md): WordPress Avantage Theme \<= 2.4.9 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-39499](https://cve.now/CVE-2025-39499.md): WordPress Medicare Theme \<= 2.1.0 - PHP Object Injection vulnerability (CVSS 9.8)
- [CVE-2025-3715](https://cve.now/CVE-2025-3715.md): Bold Page Builder \<= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter (CVSS 6.4)
- [CVE-2025-47525](https://cve.now/CVE-2025-47525.md): WordPress Bold Page Builder plugin \<= 5.3.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9)
- [CVE-2025-47488](https://cve.now/CVE-2025-47488.md): WordPress Bold Page Builder plugin \<= 5.3.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5)
- [CVE-2023-45110](https://cve.now/CVE-2023-45110.md): WordPress Bold Timeline Lite plugin \<= 1.1.9 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-54382](https://cve.now/CVE-2024-54382.md): WordPress Bold Page Builder plugin \<= 5.1.5 - Path Traversal vulnerability (CVSS 4.9)
- [CVE-2024-53801](https://cve.now/CVE-2024-53801.md): WordPress Bold Page Builder plugin \<= 5.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-50417](https://cve.now/CVE-2024-50417.md): WordPress Bold Page Builder plugin \<= 5.1.3 - Broken Access Control vulnerability (CVSS 4.3)
- [CVE-2024-52417](https://cve.now/CVE-2024-52417.md): WordPress ReConstruction theme \<= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2024-47298](https://cve.now/CVE-2024-47298.md): WordPress Bold Page Builder plugin \<= 5.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-47391](https://cve.now/CVE-2024-47391.md): WordPress Bold Page Builder plugin \< 5.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-43294](https://cve.now/CVE-2024-43294.md): WordPress Bold Timeline Lite plugin \<= 1.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-7100](https://cve.now/CVE-2024-7100.md): Bold Page Builder \<= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt\_bb\_button Shortcode (CVSS 6.4)
- [CVE-2024-2736](https://cve.now/CVE-2024-2736.md): Bold Page Builder \<= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags (CVSS 6.4)
- [CVE-2024-2735](https://cve.now/CVE-2024-2735.md): Bold Page Builder \<= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via "Price List" Element (CVSS 6.4)
- [CVE-2024-2734](https://cve.now/CVE-2024-2734.md): Bold Page Builder \<= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via AI Features (CVSS 6.4)
- [CVE-2024-2733](https://cve.now/CVE-2024-2733.md): Bold Page Builder \<= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Separator Element (CVSS 5.4)
- [CVE-2024-3267](https://cve.now/CVE-2024-3267.md): Bold Page Builder \<= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt\_bb\_price\_list Shortcode (CVSS 6.4)
- [CVE-2024-3266](https://cve.now/CVE-2024-3266.md): Bold Page Builder \<= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute (CVSS 6.4)
- [CVE-2024-30442](https://cve.now/CVE-2024-30442.md): WordPress Bold Page Builder plugin \<= 4.8.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-30179](https://cve.now/CVE-2024-30179.md): WordPress Bold Page Builder plugin \<= 4.7.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-1159](https://cve.now/CVE-2024-1159.md): Bold Page Builder \<= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Raw Content (CVSS 6.4)
- [CVE-2024-1157](https://cve.now/CVE-2024-1157.md): Bold Page Builder \<= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL (CVSS 5.4)
- [CVE-2024-1160](https://cve.now/CVE-2024-1160.md): Bold Page Builder \<= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Link (CVSS 5.4)
- [CVE-2023-49823](https://cve.now/CVE-2023-49823.md): WordPress Bold Page Builder Plugin \<= 4.6.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5)
- [CVE-2021-24321](https://cve.now/CVE-2021-24321.md): Bello \< 1.6.0 - Unauthenticated Blind SQL Injection (no CVSS)
- [CVE-2021-24320](https://cve.now/CVE-2021-24320.md): Bello \< 1.6.0 - Unauthenticated Reflected XSS & XFS (no CVSS)
- [CVE-2021-24319](https://cve.now/CVE-2021-24319.md): Bello \< 1.6.0 - Authenticated Cross-Site Scripting (XSS) and XFS (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/boldthemes
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.