Vulnerability · Published Apr 21, 2026 · Assigned by VulnCheck

CVE-2026-41456Bludit CMS Reflected XSS via Search Plugin

Medium 5.1

In plain English

A medium-severity cross-site scripting in bludit from bludit. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.5% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)3.5%top 10.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Nuclei, Public PoC

Official description

Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts in the browsers of users who visit crafted URLs containing the payload, potentially stealing session cookies or performing actions on behalf of affected users.

Affected products (as reported)

Vendor	Product	Versions
bludit	bludit	0 – through 3.20

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://gist.github.com/thepiyushkumarshukla/36b213cdb3c7d603e23fd23605cd681e technical-description, exploit
https://github.com/bludit/bludit/pull/1691 issue-tracking
https://github.com/bludit/bludit/commit/6732ddedda8b73ce0a017a1b6adf685100244e01 patch
https://www.vulncheck.com/advisories/bludit-cms-reflected-xss-via-search-plugin third-party-advisory