{"id":"CVE-2026-84021","title":"The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arb…","summary":"The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arb…","severity":"medium","cvss":6.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-79"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:09:21.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84021","references":[{"url":"https://wpscan.com/vulnerability/ca226eab-59a2-42d5-96f6-84dacf7c6c5a/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00431,"epssPercentile":0.34622,"ingestedAt":"2026-09-06T05:50:39.476Z","slug":"CVE-2026-84021","body":"## Overview\n\nThe Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the affected link.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":8276,"id":"CVE-2026-84021","ts":1788919995649,"field":"cvss","old":null,"new":"6.8"},{"seq":8275,"id":"CVE-2026-84021","ts":1788919995649,"field":"severity","old":"none","new":"medium"},{"seq":8085,"id":"CVE-2026-84021","ts":1788919281140,"field":"cvss","old":"6.8","new":null},{"seq":8084,"id":"CVE-2026-84021","ts":1788919281140,"field":"severity","old":"medium","new":"none"},{"seq":7894,"id":"CVE-2026-84021","ts":1788916356821,"field":"cvss","old":null,"new":"6.8"},{"seq":7893,"id":"CVE-2026-84021","ts":1788916356821,"field":"severity","old":"none","new":"medium"},{"seq":7703,"id":"CVE-2026-84021","ts":1788915297840,"field":"cvss","old":"6.8","new":null},{"seq":7702,"id":"CVE-2026-84021","ts":1788915297840,"field":"severity","old":"medium","new":"none"},{"seq":7512,"id":"CVE-2026-84021","ts":1788912717372,"field":"cvss","old":null,"new":"6.8"},{"seq":7511,"id":"CVE-2026-84021","ts":1788912717372,"field":"severity","old":"none","new":"medium"},{"seq":7321,"id":"CVE-2026-84021","ts":1788911331792,"field":"cvss","old":"6.8","new":null},{"seq":7320,"id":"CVE-2026-84021","ts":1788911331792,"field":"severity","old":"medium","new":"none"},{"seq":7125,"id":"CVE-2026-84021","ts":1788909079005,"field":"cvss","old":null,"new":"6.8"},{"seq":7124,"id":"CVE-2026-84021","ts":1788909079005,"field":"severity","old":"none","new":"medium"},{"seq":6937,"id":"CVE-2026-84021","ts":1788907391867,"field":"cvss","old":"6.8","new":null},{"seq":6936,"id":"CVE-2026-84021","ts":1788907391867,"field":"severity","old":"medium","new":"none"},{"seq":6739,"id":"CVE-2026-84021","ts":1788905444929,"field":"cvss","old":null,"new":"6.8"},{"seq":6738,"id":"CVE-2026-84021","ts":1788905444929,"field":"severity","old":"none","new":"medium"},{"seq":6557,"id":"CVE-2026-84021","ts":1788903460075,"field":"cvss","old":"6.8","new":null},{"seq":6556,"id":"CVE-2026-84021","ts":1788903460075,"field":"severity","old":"medium","new":"none"},{"seq":6343,"id":"CVE-2026-84021","ts":1788901811170,"field":"cvss","old":null,"new":"6.8"},{"seq":6342,"id":"CVE-2026-84021","ts":1788901811170,"field":"severity","old":"none","new":"medium"},{"seq":6173,"id":"CVE-2026-84021","ts":1788899562465,"field":"cvss","old":"6.8","new":null},{"seq":6172,"id":"CVE-2026-84021","ts":1788899562465,"field":"severity","old":"medium","new":"none"},{"seq":6041,"id":"CVE-2026-84021","ts":1788898240523,"field":"cvss","old":null,"new":"6.8"},{"seq":6040,"id":"CVE-2026-84021","ts":1788898240523,"field":"severity","old":"none","new":"medium"}]}