TI-2026-30045 Aliases CVE-2026-41456 GHSA-xmmc-cmm8-3rvm

Bludit CMS Reflected XSS via Search Plugin

MEDIUM 62CWE-79Published 2026-04-21 · Updated 2026-11-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: Active
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts in the browsers of users who visit crafted URLs containing the payload, potentially stealing session cookies or performing actions on behalf of affected users.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.03539 89th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Bludit	bludit	up to 3.20	—	Patch available	CNA

bludit VendorBludit Affected up to 3.20 Fixed in — Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:bludit:bludit::::::::	—	—	Bludit

cpe:2.3:a:bludit:bludit:*:*:*:*:*:*:*:* Versions — — ·Bludit

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2026-41456
2026-10-03 Alias added: GHSA-xmmc-cmm8-3rvm

References

Exploit 1

https://gist.github.com/thepiyushkumarshukla/36b213cdb3c7d603e23fd23605cd681e

Patch 2

TI-2019-12105 Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because… CVSS 3.1HIGH 8.8
TI-2024-16173 Bludit - Remote Code Execution (RCE) through Image API CVSS 4.0HIGH 8.9
TI-2024-16172 Bludit - Remote Code Execution (RCE) through File API CVSS 4.0HIGH 8.9
TI-2026-34301 Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessions CVSS 3.1HIGH 8.8
TI-2023-15122 An issue in Bludit 4.0.0-rc-2 allows authenticated attackers to change the Administrator… CVSS 3.1HIGH 8.8
TI-2020-13782 Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images. CVSS 3.1HIGH 8.8

See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences