CVE-2025-69345
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Missing Authorization vulnerability in BoldGrid Post and Page Builder (up to 1.27.9) allows exploiting incorrectly configured access control security levels.
Risk Assessment
Unauthorized users may gain access to administrative functions or modify content, potentially leading to site integrity compromise.
Recommendation
Update the plugin to a patched version and review access control configuration.
Other vulnerabilities in Post and Page Builder by BoldGrid
See all- CVE-2026-78001Medium
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-100510High
Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid versions <= 1.27.14.
Original NVD description (English source)
Missing Authorization vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS