CVEs we hold for Boldthemes
Records whose assigning authority named Boldthemes as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-7438Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributesboldthemes Bold Timeline Lite
CVE-2026-62110WordPress Bold Page Builder plugin <= 5.9.9 - Cross Site Scripting (XSS) vulnerabilityboldthemes Bold Page Builder
CVE-2026-5920Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameterboldthemes Bold Page Builder
CVE-2026-3694Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcodeboldthemes Bold Page Builder
CVE-2026-27369WordPress Celeste theme <= 1.3.6 - PHP Object Injection vulnerabilityBoldThemes Celeste
CVE-2026-25451WordPress Bold Page Builder plugin <= 5.6.9 - Cross Site Scripting (XSS) vulnerabilityboldthemes Bold Page Builder
CVE-2026-2357Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingboldthemes Bold Page Builder
CVE-2025-7730Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameterboldthemes Bold Page Builder
CVE-2025-68513WordPress Bold Timeline Lite plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerabilityboldthemes Bold Timeline Lite
CVE-2025-67997WordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerabilityBoldThemes Travelicious
CVE-2025-66057WordPress Bold Page Builder plugin <= 5.5.2 - Cross Site Scripting (XSS) vulnerabilityboldthemes Bold Page Builder
CVE-2025-60216WordPress Addison theme < 1.4.8 - PHP Object Injection vulnerabilityBoldThemes Addison
CVE-2025-60214WordPress Goldenblatt theme < 1.3.0 - PHP Object Injection vulnerabilityBoldThemes Goldenblatt
CVE-2025-58194WordPress Bold Page Builder Plugin <= 5.4.3 - Cross Site Scripting (XSS) Vulnerabilityboldthemes Bold Page Builder
CVE-2025-54723WordPress DentiCare Theme < 1.4.3 - PHP Object Injection VulnerabilityBoldThemes DentiCare
CVE-2025-54006WordPress Bold Page Builder plugin <= 5.4.1 - Cross Site Scripting (XSS) Vulnerabilityboldthemes Bold Page Builder
CVE-2025-5286Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameterboldthemes Bold Page Builder
CVE-2025-47525WordPress Bold Page Builder plugin <= 5.3.0 - Cross Site Scripting (XSS) Vulnerabilityboldthemes Bold Page Builder
CVE-2025-47488WordPress Bold Page Builder plugin <= 5.3.2 - Cross Site Scripting (XSS) Vulnerabilityboldthemes Bold Page Builder
CVE-2025-39499WordPress Medicare Theme <= 2.1.0 - PHP Object Injection vulnerabilityBoldThemes Medicare
CVE-2025-39495WordPress Avantage Theme <= 2.4.9 - PHP Object Injection vulnerabilityBoldThemes Avantage
CVE-2025-3715Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameterboldthemes Bold Page Builder
CVE-2025-15267Bold Page Builder <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcodeboldthemes Bold Page Builder
CVE-2025-14032Bold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in…boldthemes Bold Timeline Lite
CVE-2025-13463Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Gridboldthemes Bold Page Builder
CVE-2025-12803Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcodeboldthemes Bold Page Builder
CVE-2025-12159Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeboldthemes Bold Page Builder
CVE-2024-7100Bold Page Builder <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcodeboldthemes Bold Page Builder
CVE-2024-54382WordPress Bold Page Builder plugin <= 5.1.5 - Path Traversal vulnerabilityboldthemes Bold Page Builder
CVE-2024-53801WordPress Bold Page Builder plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerabilityboldthemes Bold Page Builder
CVE-2024-52417WordPress ReConstruction theme <= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerabilityBoldThemes ReConstruction
CVE-2024-50417WordPress Bold Page Builder plugin <= 5.1.3 - Broken Access Control vulnerabilityboldthemes Bold Page Builder
CVE-2024-47391WordPress Bold Page Builder plugin < 5.1.1 - Cross Site Scripting (XSS) vulnerabilityboldthemes Bold Page Builder
CVE-2024-47298WordPress Bold Page Builder plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerabilityboldthemes Bold Page Builder
CVE-2024-43294WordPress Bold Timeline Lite plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityBoldThemes Bold Timeline Lite
CVE-2024-3267Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcodeboldthemes Bold Page Builder
CVE-2024-3266Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attributeboldthemes Bold Page Builder
CVE-2024-30442WordPress Bold Page Builder plugin <= 4.8.0 - Cross Site Scripting (XSS) vulnerabilityBoldThemes Bold Page Builder
CVE-2024-30179WordPress Bold Page Builder plugin <= 4.7.6 - Cross Site Scripting (XSS) vulnerabilityBoldThemes Bold Page Builder
CVE-2024-2736Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tagsboldthemes Bold Page Builder
CVE-2024-2735Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via "Price List" Elementboldthemes Bold Page Builder
CVE-2024-2734Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via AI Featuresboldthemes Bold Page Builder
CVE-2024-2733Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Separator Elementboldthemes Bold Page Builder
CVE-2024-1160Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Linkboldthemes Bold Page Builder
CVE-2024-1159Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Raw Contentboldthemes Bold Page Builder
CVE-2024-1157Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URLboldthemes Bold Page Builder
CVE-2023-49823WordPress Bold Page Builder Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)BoldThemes Bold Page Builder
CVE-2023-45110WordPress Bold Timeline Lite plugin <= 1.1.9 - Broken Access Control vulnerabilityboldthemes Bold Timeline Lite
CVE-2021-24321Bello < 1.6.0 - Unauthenticated Blind SQL InjectionBoldThemes Bello - Directory & Listing
CVE-2021-24320Bello < 1.6.0 - Unauthenticated Reflected XSS & XFSBoldThemes Bello - Directory & Listing
CVE-2021-24319Bello < 1.6.0 - Authenticated Cross-Site Scripting (XSS) and XFSBoldThemes Bello - Directory & Listing
56 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.