CVE-2026-41456
MediumCVSS 5.1Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts in the browsers of users who visit crafted URLs containing the payload, potentially stealing session cookies or performing actions on behalf of affected users.
Risk Assessment
The risk for the organization includes the possibility of session theft and unauthorized actions performed on behalf of users, potentially leading to data confidentiality breaches and system integrity compromise.
Recommendation
It is recommended to immediately update Bludit CMS to a version containing commit 6732dde or later, and to implement input validation and encoding in the search plugin.
Other vulnerabilities in Bludit CMS
See all- CVE-2026-93365Medium
Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX endpoint.
- CVE-2026-93364Medium
Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request, enabling page conversion or ownership transfer.
- CVE-2026-38329Critical
Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation.
Original NVD description (English source)
Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts in the browsers of users who visit crafted URLs containing the payload, potentially stealing session cookies or performing actions on behalf of affected users.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS