Admin stored XSS via unsanitized settings

Cross-site scripting in Bold Page Builder before 4.3.3 allows remote authenticated users to execute script in an administrator’s browser. Plugin settings are stored without adequate sanitization or output escaping, allowing attacker-supplied markup or script to persist and execute when administrative pages render those values. Exploitation requires a high-privilege WordPress account and administrator interaction with affected content; the demonstrated consequence is script execution in that browser context, enabling unauthorized data or action access available to the administrator.