These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A Cross Site Scripting (XSS) vulnerability exists in Bold Page Builder versions up to 5.9.9. This CVE was published on 2026-09-11T19:17:43.850Z and last modified on 2026-09-11T21:17:12.233Z.
The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This vulnerability allows authenticated attackers with Contributor-level access and above to inject ar [truncated]
CVE-2026-27429 is a critical vulnerability in the Nifty theme for WordPress, allowing unauthenticated PHP object injection. It has a CVSS score of 9.8 and was published on June 17, 2026. The vulnerability affects Nifty versions up to 1.4.1. Successful exploitation could lead to high impact on confidentiality, integrity, and availability. Administrators of affected systems should apply patches or mitigatio [truncated]
The Bold Page Builder plugin for WordPress has a Stored Cross-Site Scripting vulnerability via the bt_bb_accordion_item shortcode in all versions up to, and including, 5.6.1. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute when a user accesses an injected page. The vulnerability was reported by [email protected] an [truncated]