Bold Page Builder Security & Risk Analysis
wordpress.org/plugins/bold-page-builderFree Page Builder and Visual Composer - Build stunning responsive post and page layouts with easy to use drag and drop builder - no coding required.
Is Bold Page Builder Safe to Use in 2026?
High Risk
Score 31/100Bold Page Builder carries significant security risk with 33 known CVEs, 5 still unpatched. Consider switching to a maintained alternative.
The 'bold-page-builder' v5.6.9 plugin presents a mixed security posture. On the positive side, it shows good practices with 100% of SQL queries using prepared statements and a high percentage (85%) of properly escaped output. The absence of critical or high severity taint flows is also a strong indicator of secure coding in those areas. However, significant concerns arise from the substantial vulnerability history, with 33 known CVEs, including 5 currently unpatched. The prevalence of common vulnerability types like XSS, Path Traversal, Missing Authorization, and Deserialization of Untrusted Data suggests recurring security weaknesses that have not been fully addressed.
The static analysis reveals an attack surface of 15 entry points, with 4 AJAX handlers lacking authentication checks. This is a direct pathway for unauthorized actions if exploited. The presence of the `unserialize` function, a known dangerous function often associated with deserialization vulnerabilities, is another critical flag, especially given the plugin's history with such issues. While taint analysis shows no critical or high unsanitized flows, the combination of the dangerous function and a history of deserialization vulnerabilities warrants extreme caution. The 5 unpatched CVEs, particularly those with medium severity, indicate that existing vulnerabilities are still exploitable, further increasing the risk.
In conclusion, while the plugin demonstrates some secure coding practices in specific areas, the extensive and recurring vulnerability history, coupled with the presence of unprotected AJAX handlers and a dangerous function, points to a high-risk plugin. The 5 unpatched CVEs are the most immediate and concerning threat, demanding prompt attention. Users should consider this plugin high-risk until all known vulnerabilities are patched and a thorough audit of the identified weaknesses (unprotected AJAX, unserialize usage) is conducted.
Key Concerns
- Unpatched CVEs
- AJAX handlers without auth checks
- Dangerous function (unserialize) used
Bold Page Builder Security Vulnerabilities
CVEs by Year
Severity Breakdown
33 total CVEs
Bold Page Builder <= 5.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid
Bold Builder <= 5.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_tabs Shortcode
Bold Page Builder <= 5.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode
Bold Page Builder <= 5.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder <= 5.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter
Bold Page Builder <= 5.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder <= 5.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Builder <= 5.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via additional_settings Parameter
Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter
Bold Page Builder <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder <= 5.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Bold Page Builder <= 5.1.5 - Authenticated (Editor+) Path Traversal
Bold Page Builder <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder <= 5.1.3 - Missing Authorization
Bold Page Builder <= 5.1.- - Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode
Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Separator Element
Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via AI Features
Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via "Price List" Element
Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute
Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode
Bold Page Builder <= 4.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via class
Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Link
Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL
Bold Page Builder <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Raw Content
Bold Page Builder <= 4.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Bold Page Builder <= 4.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting
Bold Page Builder <= 3.1.5 - PHP Object Injection
Bold Page Builder <= 2.3.1 - Missing Authorization to Settings Update
Bold Page Builder Code Analysis
Dangerous Functions Found
SQL Query Safety
Output Escaping
Data Flow Analysis
Bold Page Builder Attack Surface
AJAX Handlers 15
WordPress Hooks 61
Maintenance & Trust
Bold Page Builder Maintenance & Trust
Maintenance Signals
Community Trust
Bold Page Builder Alternatives
Page Builder by SiteOrigin
siteorigin-panels
Build responsive page layouts using the widgets you know and love using this simple drag and drop page builder.
Zion Builder – Website Builder for Speed & Creativity
zionbuilder
Building websites just got easier! Zion Builder is a visual website builder with powerful design features to help you build interactive websites.
LoftBuilder
loftbuilder
Create stunning and responsive pages with LoftBuilder. An intuitive front-end looking, drag & drop page builder.
Elementor Website Builder – More Than Just a Page Builder
elementor
The Elementor Website Builder has it all: drag and drop page builder, pixel perfect design, mobile responsive editing, and more. Get started now!
Page Builder: Pagelayer – Drag and Drop website builder
pagelayer
The most advanced frontend drag & drop page builder. Pagelayer is a light weight but extremely powerful Website Builder.
Bold Page Builder Developer Profile
8 plugins · 69K total installs
How We Detect Bold Page Builder
Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.
Asset Fingerprints
/wp-content/plugins/bold-page-builder/bold-builder.min.css/wp-content/plugins/bold-page-builder/bold-builder.min.js/wp-content/plugins/bold-page-builder/editor/css/bold-builder-editor.min.css/wp-content/plugins/bold-page-builder/editor/js/bold-builder-editor.min.js/wp-content/plugins/bold-page-builder/editor/js/bold-builder-editor-vendor.min.js/wp-content/plugins/bold-page-builder/bold-builder.min.js/wp-content/plugins/bold-page-builder/editor/js/bold-builder-editor-vendor.min.js/wp-content/plugins/bold-page-builder/editor/js/bold-builder-editor.min.jsbold-page-builder/bold-builder.min.css?ver=bold-page-builder/bold-builder.min.js?ver=bold-page-builder/editor/css/bold-builder-editor.min.css?ver=bold-page-builder/editor/js/bold-builder-editor.min.js?ver=bold-page-builder/editor/js/bold-builder-editor-vendor.min.js?ver=HTML / DOM Fingerprints
bt_bb_wrapperbt_bb_fe_wrapbt_bb_fe_add_templatebt_bb_fe_add_template_listbt_bb_fe_preview_togglerbt_bb_fe_add_elementsbt_bb_fe_undobt_bb_fe_redo+3 moredata-templates-timedata-layout-iddata-edit_urlBT_BB_VERSIONBT_BB_FEATURE_ADD_ELEMENTSbt_bb_mapbt_bb_arraybt_bb_fe_arraybt_bb_fe_array_depth<div class="bt_bb_wrapper"<div class="bt_bb_fe_wrap"><div class="bt_bb_fe_add_template"><div class="bt_bb_fe_add_template_list">