---
id: CVE-2026-41456
title: Bludit CMS Reflected XSS via Search Plugin
summary: >-
  Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting
  vulnerability in the search plugin that allows unauthenticated attackers to
  inject arbitrary JavaScript by crafting a malicious search query. Attackers
  can exec…
severity: medium
cvss: 5.1
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: bludit
product: bludit
affected:
  - bludit <= 3.20
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-04-21T18:46:25.604166Z'
exploitAvailable: true
published: '2026-04-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:03:06.339Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-41456'
references:
  - url: >-
      https://gist.github.com/thepiyushkumarshukla/36b213cdb3c7d603e23fd23605cd681e
  - url: 'https://github.com/bludit/bludit/pull/1691'
  - url: >-
      https://github.com/bludit/bludit/commit/6732ddedda8b73ce0a017a1b6adf685100244e01
  - url: >-
      https://www.vulncheck.com/advisories/bludit-cms-reflected-xss-via-search-plugin
tags:
  - cve.org
  - exploit-available
epss: 0.03539
epssPercentile: 0.8936
exploits:
  exploitdb: true
  github: 1
  githubRepos:
    - 'https://github.com/lowlevelsec/Reflected-XSS-Bludit-CVE-2026-41456'
  nuclei:
    - CVE-2026-41456
  checkedAt: '2026-11-08T14:51:57.346Z'
ingestedAt: '2026-11-08T14:51:22.437Z'
---

## Overview

Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts in the browsers of users who visit crafted URLs containing the payload, potentially stealing session cookies or performing actions on behalf of affected users.

## Affected

- `bludit <= 3.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.