PT-2026-34045 · Bludit · Bludit

Published 2026-04-21 · Updated 2026-04-21 · CVE-2026-41456

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Bludit CMS versions prior to commit 6732dde

Description A reflected cross-site scripting issue exists in the search plugin. This allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Malicious scripts can be executed in the browsers of users who visit crafted URLs containing the payload, which may lead to the theft of session cookies or actions performed on behalf of the affected users.

Recommendations Update to the version containing commit 6732dde.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41456

Affected Products

Bludit

References · 6

• 🔥 https://gist.github.com/thepiyushkumarshukla/36b213cdb3c7d603e23fd23605cd681e · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-41456 · Security Note
• https://github.com/bludit/bludit/commit/6732ddedda8b73ce0a017a1b6adf685100244e01 · Patch
• https://github.com/bludit/bludit/pull/1691 · Note
• https://vulncheck.com/advisories/bludit-cms-reflected-xss-via-search-plugin · Note
• https://twitter.com/CVEnew/status/2046675000220926262 · Twitter Post