Post and Page Builder by BoldGrid Vulnerability – Visual Drag and Drop Editor – Authenticated (Contributor+) Stored Cross-Site Scripting |WordPress Plugin Vulnerability Report

Plugin Name: Post and Page Builder by BoldGrid – Visual Drag and Drop Editor

Key Information:

  • Software Type: Plugin
  • Software Slug: post-and-page-builder
  • Software Status: Active
  • Software Author: BoldGrid
  • Software Downloads: 1,381,114
  • Active Installs: 80,000
  • Last Updated: March 25, 2024
  • Patched Versions: 1.26.3
  • Affected Versions: <= 1.26.2

Vulnerability Details:

  • Name: Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin <= 1.26.2
  • Title: Authenticated (Contributor+) Stored Cross-Site Scripting
  • Type: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
  • CVSS Score: 6.4
  • Publicly Published: March 25, 2024
  • Researcher: Phill Sav (Savphill)
  • Description: The Post and Page Builder by BoldGrid plugin is vulnerable to Stored Cross-Site Scripting (XSS) through its Block HTML functionality, affecting all versions up to and including 1.26.2. This vulnerability stems from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to insert arbitrary web scripts that execute upon page access by any user.


The Post and Page Builder plugin, an essential tool for WordPress site customization, harbors a critical vulnerability in versions up to and including 1.26.2, facilitating stored cross-site scripting through Block HTML. This vulnerability has been effectively addressed in the latest version, 1.26.3.

Detailed Overview:

Discovered by security researcher Phill Sav, this vulnerability places websites at risk by enabling attackers to inject harmful scripts into web pages, potentially leading to unauthorized access, data theft, and other malicious activities. The exploit occurs within the Block HTML functionality of the plugin, where inadequate input sanitization and output escaping provide an avenue for script injection. This not only compromises the security of the website but also endangers the data and privacy of its users.

Advice for Users:

To mitigate this risk, users of the Post and Page Builder plugin are urged to update to the patched version, 1.26.3, without delay. Additionally, website administrators should review their sites for any signs of unauthorized activities or content alterations, especially if the vulnerable versions of the plugin were previously in use. While the patched version restores security, exploring alternative plugins with similar capabilities could serve as a precautionary measure. Above all, maintaining the latest versions of all WordPress plugins is critical for ensuring website security.


The swift response by BoldGrid to address this vulnerability highlights the crucial role of timely software updates in maintaining website security. Users are advised to confirm that their installations of the Post and Page Builder plugin are updated to version 1.26.3 or later, securing their WordPress sites against potential exploits associated with this vulnerability.


Detailed Report: 

In the digital realm where WordPress powers a significant portion of the web, plugins like the Post and Page Builder by BoldGrid are indispensable tools for crafting engaging websites. However, the recent uncovering of a Stored Cross-Site Scripting (XSS) vulnerability in this widely-used plugin serves as a stark reminder of the continuous battle for cybersecurity. This vulnerability, identified in versions up to and including 1.26.2, underscores the critical importance of maintaining up-to-date software to safeguard online assets against potential threats.

Plugin Overview

The Post and Page Builder by BoldGrid is celebrated for its user-friendly, visual drag-and-drop interface, enabling site owners to construct and customize their pages with ease. Boasting over 1.3 million downloads and 80,000 active installations, its role in the WordPress ecosystem is undeniably significant. Authored by BoldGrid and last updated on March 25, 2024, this plugin's recent versions have addressed crucial security concerns to enhance user trust and safety.

Vulnerability Insights

The vulnerability in question, stemming from insufficient input sanitization and output escaping within the plugin's Block HTML functionality, allows authenticated users with contributor-level access or higher to inject harmful scripts. These scripts could execute arbitrary code whenever a user accesses an affected page, posing risks such as data breaches, unauthorized access, and the potential compromise of entire websites. Highlighted by researcher Phill Sav, this vulnerability, although without a CVE identifier, carries a CVSS score of 6.4, signaling a significant security risk.

Potential Risks and Impacts

The implications of such a vulnerability are far-reaching, particularly for small business owners who rely on their websites as primary points of customer interaction and commerce. A compromised website can lead to loss of sensitive customer data, erosion of user trust, and significant damage to the business's reputation. In worst-case scenarios, it could also result in regulatory penalties, especially if personal data is involved.

Remediation and Proactive Measures

In response to this vulnerability, BoldGrid swiftly released a patched version of the plugin, 1.26.3, effectively mitigating the risk. Users of the plugin are strongly encouraged to update to this latest version immediately to secure their sites. Furthermore, regular site audits and security checks can help identify and rectify potential vulnerabilities, while exploring alternative plugins could provide additional layers of security.

Navigating Past Vulnerabilities

It's noteworthy that this isn't the first security challenge faced by the Post and Page Builder plugin, with previous vulnerabilities reported since August 22, 2023. These instances highlight the evolving nature of cybersecurity threats and the imperative for continuous vigilance and updates.


For small business owners, the digital space offers immense opportunities but also brings with it the responsibility of ensuring cybersecurity. The recent vulnerability in the Post and Page Builder plugin by BoldGrid reinforces the need for regular software updates as a fundamental practice. Staying informed about potential vulnerabilities and adopting a proactive stance towards website security can protect your business from unforeseen threats, ensuring that your digital presence remains secure and reliable for your customers. In the fast-paced world of digital business, making time for these critical updates isn't just a best practice—it's a necessity for safeguarding your digital assets and maintaining the trust of those who rely on your online presence.

Staying Secure

Staying on top of WordPress security can feel overwhelming for small business owners without dedicated IT staff. At Your WP Guy, we exist to shoulder that burden for you. Our WordPress experts can fully audit, secure, maintain and support your site - so you can focus on growing your business with peace of mind.

Don't tackle security risks alone. Let us help you assess any impact from this vulnerability, update your plugins, and implement ongoing maintenance to avoid future threats. We treat your website like it's our own - because we know how critical it is for reaching your customers.

Get in touch for a free consultation today on making WordPress security stress-free. Call 678-995-5169 or book a call here. Our knowledgeable team is ready to help you safeguard your online presence.

Post and Page Builder by BoldGrid Vulnerability – Visual Drag and Drop Editor – Authenticated (Contributor+) Stored Cross-Site Scripting |WordPress Plugin Vulnerability Report FAQs

Leave a Comment