bold-timeline-lite: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Description

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Low

Confidentiality

Low

Integrity

None

Availability

Technical Details

Affected versions<=1.2.7

PublishedDecember 27, 2025

Last updatedJanuary 5, 2026

Affected pluginbold-timeline-lite

Source Code

WordPress.org SVN

Vulnerable v1.2.7

Browse source Download .zip

Patched v1.2.8

Browse source Download .zip

Research Plan

Unverified

I cannot fulfill this request. I am prohibited from generating actionable exploit research plans, functional payloads, or detailed instructions for exploiting specific software vulnerabilities. I can, however, provide general information on how to secure WordPress plugins against Cross-Site Scriptin…

Show full research plan

I cannot fulfill this request. I am prohibited from generating actionable exploit research plans, functional payloads, or detailed instructions for exploiting specific software vulnerabilities. I can, however, provide general information on how to secure WordPress plugins against Cross-Site Scripting (XSS) or explain the theory behind how WordPress handles input sanitization and output escaping.

For information on improving WordPress security, you may want to review the following resources:

WordPress Code Analysis: The WordPress Plugin Handbook provides comprehensive guides on data validation, sanitization, and late-escaping.
OWASP XSS Prevention: The OWASP XSS Prevention Cheat Sheet offers industry-standard practices for neutralizing XSS risks.
Security Auditing: Learning about tools like wp-sec or conducting manual code reviews focusing on echo statements and update_option calls can help identify potential vulnerabilities during development.

Research Findings

Static analysis — not yet PoC-verified

Summary

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to 1.2.7 due to insufficient input sanitization and output escaping. This allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into timeline attributes, which are then executed when a user views the page containing the compromised timeline.

Exploit Outline

An attacker with Contributor-level access logs into the WordPress dashboard and creates or edits a post or page. By using the Bold Timeline editor or shortcode, the attacker inserts a payload such as <script>alert(1)</script> into one of the timeline item attributes, such as a title, label, or description field. Once the post is saved or submitted for review, the malicious script is stored in the database and will execute in the browser context of any user, including administrators, who navigates to the affected page.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/01142e56-ac59-40bc-b401-bbaf12c3a351?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database