CVE-2026-78001

Executive Summary

CVE-2026-78001 is a stored cross-site scripting (XSS) vulnerability in the BoldGrid "Post and Page Builder – Visual Drag and Drop Editor" plugin for WordPress, affecting all versions up to and including 1.27.13. The flaw resides in the Table Designer component's handling of the data-label attribute, where insufficient input sanitization and output escaping permit authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. When a victim accesses an injected page, the malicious script executes in their browser session, enabling session hijacking, credential theft, and privileged actions in the context of the victim user.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-Site Scripting) and specifically manifests as a stored (persistent) XSS condition. The affected component is the Table Designer feature within the BoldGrid Post and Page Builder plugin, a visual drag-and-drop editor that allows content authors to construct page layouts and tables through a browser-based interface.

The root cause, per the NVD description, is insufficient input sanitization and insufficient output escaping. The attack vector is the data-label attribute of the Table Designer. In a WordPress context, this attribute is populated by content authors when configuring table columns and is subsequently rendered into the page's HTML. Because the plugin fails to sanitize the value on input and fails to escape it on output, an attacker-controlled string supplied to data-label is persisted in the site database and emitted into HTML responses to other users.

The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates the following: the attack is network-exploitable (AV:N), requires low complexity (AC:L), and requires low privileges (PR:L) — consistent with the Contributor role required by the description. Notably, User Interaction is None (UI:N) even for a stored XSS, because the payload executes automatically when a page containing the injected content is viewed; the victim does not need to click a link or interact with a UI element beyond loading the affected page. The Scope is Changed (S:C), because the vulnerable component (the plugin) can affect resources beyond its security scope — namely the browsing context and session of any user who views the injected page, including higher-privileged editors and administrators.

The specific functions, classes, or file paths responsible for the sanitization failure are not identified in the available data. No public proof-of-concept or exploit code is available. The attack chain below is therefore described at the vulnerability-class level.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the information provided in the NVD description. Only the data-label attribute and the Table Designer feature are explicitly referenced in the source data.

1. Reconnaissance / Target Identification. An attacker identifies WordPress sites running the Post and Page Builder by BoldGrid plugin at version 1.27.13 or below. This can be accomplished through passive fingerprinting of the plugin's front-end assets (e.g., the post-and-page-builder plugin directory path in HTML/asset references) or active scanning. Sites permitting self-registration or accepting external contributor accounts are prioritized.

2. Access Acquisition. The attacker obtains authenticated access at Contributor level or higher. In many WordPress deployments, Contributor accounts can be self-provisioned if registration is open, or obtained via social engineering, credential stuffing, or purchase. No higher privilege is required.

3. Triggering the Flaw. Using the Table Designer in the plugin's visual editor, the attacker configures a table and supplies a crafted value to the data-label attribute. Because the value is neither sanitized on input nor escaped on output, malicious markup containing a script payload is persisted into the page content in the database. The precise injection syntax is not documented in the available data and would depend on the rendering context; the vulnerability class (stored XSS via an HTML attribute) governs the payload construction approach.

4. Execution and Post-Exploitation Impact. When any user — including Editors, Administrators, or unauthenticated visitors — loads the page containing the injected content, the attacker's script executes in that user's browser within the origin of the vulnerable site. The stored payload executes automatically (UI:N). Impact includes theft of session cookies (potentially leading to full account takeover if the victim holds elevated privileges), arbitrary actions performed as the victim via the authenticated session, credential phishing rendered within a trusted page, and malware or redirect injection into the browsing session. Because the script runs with the trust of the WordPress origin, HttpOnly and SameSite defenses may mitigate cookie theft but do not prevent in-session actions, DOM manipulation, or credential harvesting.

Impact Assessment

The CVSS v3.1 base score is 6.4 (Medium). Subscores: Confidentiality Low (C:L), Integrity Low (I:L), Availability None (A:N), and Scope Changed (S:C). The low privileges requirement (PR:L) and network attack vector (AV:N) make exploitation accessible to any authenticated Contributor. Stored XSS in a CMS context is disproportionately impactful because payload execution occurs in the sessions of other users, including administrative users, on a recurring basis for every page view until remediated.

Business impact includes: unauthorized access to user sessions and potential full administrative takeover of affected WordPress sites; persistent modification of site content; potential distribution of malicious content to site visitors; reputational damage; and downstream compromise of visitors' browsers. The blast radius is every user who views an injected page, with elevated risk for administrators whose sessions may yield site-wide control. Availability is unaffected per the vector, but integrity and confidentiality impacts can cascade beyond the stated Low ratings once account takeover is achieved. Managed service providers hosting numerous WordPress instances with the plugin are especially exposed.

Detection Guidance

Sigma Rule

title: BoldGrid Post and Page Builder Stored XSS via Table Designer data-label
id: 8f2a6c11-4b7e-4d2a-9e3f-78001b01a001
status: experimental
description: Detects attempts to store script content in the Table Designer data-label attribute in BoldGrid Post and Page Builder (CVE-2026-78001)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78001
author: valtersit.com
logsource:
  product: wordpress
  service: web
detection:
  selection_attr:
    http.request.body|contains|all:
      - 'data-label'
      - '<script'
  selection_attr_event:
    http.request.body|contains|all:
      - 'data-label'
      - 'onerror='
  selection_edit:
    cs-uri-query|contains:
      - 'post-and-page-builder'
  condition: (selection_attr or selection_attr_event) and selection_edit
falsepositives:
  - Legitimate table labels containing the word script in benign context
level: medium
tags:
  - attack.t1059.007
  - cve.2026-78001

YARA Rule

rule CVE_2026_78001_BoldGrid_Stored_XSS
{
    meta:
        description = "Detects BoldGrid Post and Page Builder stored XSS payloads in Table Designer data-label attribute"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78001"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $label = "data-label" ascii wide nocase
        $s1 = "<script" ascii wide nocase
        $s2 = "onerror=" ascii wide nocase
        $s3 = "onload=" ascii wide nocase
        $s4 = "javascript:" ascii wide nocase

    condition:
        $label and any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-78001 BoldGrid Post and Page Builder Stored XSS via data-label"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"data-label"; nocase; http.request_body; pcre:"/(<script|onerror\s*=|onload\s*=|javascript:)/i"; classtype:web-application-attack; reference:cve,2026-78001; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-78001; sid:7800010; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [http where http.request.method == "POST" and
     http.request.body contains "data-label" and
     (http.request.body contains "<script" or
      http.request.body contains "onerror=" or
      http.request.body contains "onload=")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=wordpress
| eval body=coalesce(form_data, request_body, "")
| search body="*data-label*"
| where match(body, "(?i)(<script|onerror\s*=|onload\s*=|javascript:)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, host
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-78001,">
  <rule id="780010" level="10">
    <decoded_as>json</decoded_as>
    <field name="http.request.body">data-label</field>
    <regex type="pcre2">(?i)(&lt;script|onerror\s*=|onload\s*=|javascript:)</regex>
    <description>CVE-2026-78001: BoldGrid Post and Page Builder stored XSS payload submitted via data-label attribute</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
    <group>cve_2026_78001,</group>
  </rule>
  <rule id="780011" level="12">
    <if_sid>780010</if_sid>
    <field name="http.request.uri">post-and-page-builder</field>
    <description>CVE-2026-78001: Confirmed plugin request with suspected stored XSS payload</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or workaround is documented in the available data.

1. Immediate Mitigations.

   • Audit user roles and remove or restrict Contributor-level accounts that are not strictly required. Because exploitation requires PR:L, reducing the number of Contributor+ accounts directly shrinks the attack surface.
   • Disable open self-registration if Contributor roles can be self-provisioned.
   • As a compensating control, deploy a Web Application Firewall (WAF) with rules that block script-bearing content in the data-label parameter and generic XSS patterns in POST bodies targeting the plugin.
   • Restrict the Table Designer feature via role/permission plugins if it is not operationally required for Contributor users.
   • Deploy the detection rules in the Detection Guidance section to identify injection attempts in web logs.

2. Patch / Upgrade Steps.

   • No patched version is available as of this writing. Monitor the vendor (BoldGrid) and the WordPress plugin repository for a fixed release and upgrade immediately once released.
   • Deactivate and uninstall the plugin if a patched version does not become available and the plugin is not business-critical.
   • After any upgrade, re-scan stored content for injected data-label values and sanitize or remove any persisted payloads.

3. Long-term Hardening.

   • Enforce Content Security Policy (CSP) headers on WordPress sites to reduce the impact of XSS, especially Inline script execution.
   • Apply defense-in-depth input validation and output encoding across custom WordPress plugin code; require context-aware escaping for HTML attributes.
   • Maintain an inventory of WordPress plugins and versions and subscribe to vulnerability feeds for timely patching.
   • Implement role reviews and least-privilege principles so that content authors cannot inject raw markup.
   • Enable logging and monitoring of authenticated content submissions for anomalous script content.

References

• NVD — CVE-2026-78001: https://nvd.nist.gov/vuln/detail/CVE-2026-78001
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• WordPress Plugin Directory — Post and Page Builder by BoldGrid: https://wordpress.org/plugins/post-and-page-builder/
• MITRE ATT&CK — T1059.007 Command and Scripting Interpreter: JavaScript: https://attack.mitre.org/techniques/T1059/007/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No exploit-in-the-wild evidence or threat actor campaign is associated with CVE-2026-78001 in the data provided. CISA KEV status: NO. No Nuclei template or public exploit code is available.