CVE-2026-41456

Bludit CMS Reflected XSS via Search Plugin

CVSS 5.1 MEDIUMEPSS 0.4%CWE-79

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 5.1EPSS 0.4%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado

Lifecycle

21 Apr 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts in the browsers of users who visit crafted URLs containing the payload, potentially stealing session cookies or performing actions on behalf of affected users.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected products

bludit · bludit

public PoCs found — 1

cve_referencegist.github.com/thepiyushkumarshukla/36b213cdb3c7d603e23fd23605cd681eunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://gist.github.com/thepiyushkumarshukla/36b213cdb3c7d603e23fd23605cd681e https://github.com/bludit/bludit/commit/6732ddedda8b73ce0a017a1b6adf685100244e01 https://github.com/bludit/bludit/pull/1691 https://www.vulncheck.com/advisories/bludit-cms-reflected-xss-via-search-plugin