Bludit CMS Stored XSS in Post Content (CVE-2026-27742)
Author: Beatriz Fresno Naumova, Catalin Iovita
Date: 23/02/2026
Vendor: Bludit
Product: Bludit CMS
Versions affected: ≤ 3.16.2
Component: Post content functionality
CWE: CWE-79 – Improper Neutralization of Input During Web Page Generation (XSS)
Attack type: Remote
Impact: Stored Cross-Site Scripting (XSS)
Description
Bludit CMS versions up to and including 3.16.2 are affected by a stored Cross-Site Scripting (XSS) vulnerability in the post content functionality.
The application performs input sanitization on the client side but does not enforce equivalent validation or context-aware output encoding on the server side. As a result, an authenticated user can inject arbitrary JavaScript into the content fieldwhen creating or editing a post.
The malicious payload is stored persistently and later rendered to other users without proper output encoding. When the affected post is viewed, the injected script executes in the victim’s browser context.
This allows arbitrary JavaScript execution within the privilege scope of the affected user.
Impact
Primary impact
Execution of arbitrary JavaScript in the victim’s browser session.
Possible consequences
Session hijacking
Credential theft
Content manipulation
Privilege abuse within the application
Unauthorized actions performed on behalf of the victim
Potential compromise of application integrity
CVSS Details
CVSS v4.0 Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Base Score: 5.1 (Medium)
CVSS v3.1 Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score: 5.4 (Medium)
Solution
No official fix was available at the time of disclosure.
Recommendation
Implement server-side sanitization of user-supplied content
Apply strict context-aware output encoding when rendering post content
Do not rely solely on client-side validation
Perform security testing on content rendering components
Mitigation
Encode all user-controlled input before rendering it in HTML contexts
Implement Content Security Policy (CSP) headers
Restrict dangerous HTML tags and JavaScript execution within content fields
Conduct regular security reviews of content creation and rendering workflows
Discoverers
Beatriz Fresno Naumova
Catalin Iovita (@catalin-iovita)
References
CVE Record: https://www.cve.org/CVERecord?id=CVE-2026-27742
VulnCheck Advisory: https://www.vulncheck.com/advisories/bludit-stored-xss-in-post-content
Vendor Website: https://www.bludit.com/
Last updated