{"id":"CVE-2026-7438","aliases":["EUVD-2026-75940","GHSA-8jh7-x47m-hvc2"],"status":"published","title":"Bold Timeline Lite \u003c= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","description":"The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00357,"percentile":0.29689,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-09-11T03:39:39Z","modified":"2026-09-11T14:17:34Z","products":[{"vendor":"boldthemes","product":"bold timeline lite"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/e739b324-f833-4b31-8d4c-40538c924ddf?source=cve"},{"url":"https://wordpress.org/plugins/bold-timeline-lite"},{"url":"https://plugins.trac.wordpress.org/browser/bold-timeline-lite/trunk/assets/views/bold_timeline_item_view.php#L202"},{"url":"https://plugins.trac.wordpress.org/browser/bold-timeline-lite/tags/1.2.8/assets/views/bold_timeline_item_view.php#L202"},{"url":"https://plugins.trac.wordpress.org/browser/bold-timeline-lite/trunk/assets/views/bold_timeline_item_view.php#L204"},{"url":"https://plugins.trac.wordpress.org/browser/bold-timeline-lite/tags/1.2.8/assets/views/bold_timeline_item_view.php#L204"},{"url":"https://plugins.trac.wordpress.org/browser/bold-timeline-lite/tags/1.2.8/content_elements/bold_timeline_item/bold_timeline_item.php#L10"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3556837%40bold-timeline-lite%2Ftrunk%2Fassets%2Fviews%2Fbold_timeline_item_view.php\u0026old=3417223%40bold-timeline-lite%2Ftrunk%2Fassets%2Fviews%2Fbold_timeline_item_view.php\u0026sfp_email=\u0026sfph_mail="},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7438"},{"url":"https://github.com/advisories/GHSA-8jh7-x47m-hvc2"}],"sources":{"cve":[{"id":"CVE-2026-7438","title":"Bold Timeline Lite \u003c= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes","description":"The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-09-11T03:39:39.542Z","modified":"2026-09-11T13:46:23.403Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:05.830416Z"}],"euvd":[{"id":"EUVD-2026-75940","description":"The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-09-11T03:39:39Z","modified":"2026-09-11T13:46:23Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:28:22.994693Z"}],"ghsa":[{"id":"GHSA-8jh7-x47m-hvc2","title":"The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ...","description":"The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-09-11T06:31:13Z","modified":"2026-09-11T06:31:21Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:11:44.427999Z"}],"nvd":[{"id":"CVE-2026-7438","description":"The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-09-11T04:17:55.657Z","modified":"2026-09-11T14:17:34.48Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:46.271848Z"}]}}