CVE-2026-27742
Bludit <= 3.16.2 Stored XSS in Post Content
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Bludit version 3.16.2 contains a stored cross-site scripting (XSS) vulnerability in the post content functionality. The application performs client-side sanitation of content input but does not enforce equivalent sanitation on the server side. An authenticated user can inject arbitrary JavaScript into the content field of a post, which is stored and later rendered to other users without proper output encoding. When viewed, the injected script executes in the context of the victim’s browser, allowing session hijacking, credential theft, content manipulation, or other actions within the user’s privileges.
| CWE | CWE-79 |
| Vendor | bludit |
| Product | bludit |
| Published | Feb 23, 2026 |
| Last Updated | Mar 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for bludit bludit
Be the first to know when new medium vulnerabilities affecting bludit bludit are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
Bludit / Bludit
0 ≤ 3.16.2
References
Credits
Catalin Iovita (@catalin-iovita) Beatriz Fresno Naumova