Post and Page Builder by BoldGrid vulnerabilities

The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid versions <= 1.27.14.

Missing Authorization vulnerability in BoldGrid Post and Page Builder (up to 1.27.9) allows exploiting incorrectly configured access control security levels.