CVE-2026-41456
Bludit CMS Reflected XSS via Search Plugin
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts in the browsers of users who visit crafted URLs containing the payload, potentially stealing session cookies or performing actions on behalf of affected users.
| CWE | CWE-79 |
| Vendor | bludit |
| Product | bludit |
| Published | Apr 21, 2026 |
| Last Updated | Apr 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for bludit bludit
Be the first to know when new unknown vulnerabilities affecting bludit bludit are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
bludit / bludit
0 ≤ 3.20 6732ddedda8b73ce0a017a1b6adf685100244e01
References
gist.github.com: https://gist.github.com/thepiyushkumarshukla/36b213cdb3c7d603e23fd23605cd681e github.com: https://github.com/bludit/bludit/pull/1691 github.com: https://github.com/bludit/bludit/commit/6732ddedda8b73ce0a017a1b6adf685100244e01 vulncheck.com: https://www.vulncheck.com/advisories/bludit-cms-reflected-xss-via-search-plugin
Credits
Piyush Kumar Shukla