CVE-2026-7438

Name of the Vulnerable Software and Affected Versions Bold Timeline Lite versions prior to 1.2.9

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes within the bold timeline item shortcode. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts via the supertitle and subtitle attributes. These scripts execute whenever a user accesses the affected page.

Recommendations Update Bold Timeline Lite to version 1.2.9 or later. As a temporary mitigation, restrict the use of the supertitle and subtitle attributes in the bold timeline item shortcode for users with Contributor-level access.