# CVE-2026-41456: Bludit CMS reflected XSS in search plugin

Source: https://junglewise.ai/threats/cve-2026-41456-bludit-cms-reflected-xss-in-search-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-21. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2026-41456 · Severity: info · CVSS 5.1 · Published 2026-04-21

Bludit CMS, a popular content management system, contains a security flaw in its search functionality. An attacker can trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's browser. This could lead to the theft of login sessions or sensitive information, potentially allowing an attacker to take control of the website if an administrator is targeted.

Technologies: [Bludit](https://junglewise.ai/threats/technologies/bludit). Vendors: [Bludit](https://junglewise.ai/threats/vendors/bludit).

## Quick answers

**Is CVE-2026-41456 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41456 being exploited in the wild.

**How severe is CVE-2026-41456?** Informational severity, with a CVSS score of 5.1, published 21 April 2026.

**Which products and versions are affected?** Bludit <= 3.20.

**Is there a fix for CVE-2026-41456?** A patch was published on 2026-04-19: Fix submitted via pull request 1691 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41456 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41456?** Check whether you run Bludit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in Bludit CMS versions up to 3.20 within the search plugin. The root cause is the improper neutralization of user-supplied input before it is rendered in the search results page, specifically failing to HTML-escape search terms and URLs. An unauthenticated remote attacker can exploit this by crafting a URL containing a malicious JavaScript payload in the search query parameter. If a victim visits this URL, the script executes in their browser context, potentially allowing for session cookie theft or unauthorized actions. The issue is resolved in commit 6732dde by implementing context-aware HTML escaping using htmlspecialchars.

## Affected products

- Bludit Bludit CMS <= 3.20

## Timeline

- 2026-04-19: patched: Fix submitted via pull request 1691
- 2026-04-21: disclosed: Vulnerability details and CVE published

## References

- [https://gist.github.com/thepiyushkumarshukla/36b213cdb3c7d603e23fd23605cd681e](https://gist.github.com/thepiyushkumarshukla/36b213cdb3c7d603e23fd23605cd681e)
- [https://github.com/bludit/bludit/commit/6732ddedda8b73ce0a017a1b6adf685100244e01](https://github.com/bludit/bludit/commit/6732ddedda8b73ce0a017a1b6adf685100244e01)
- [https://github.com/bludit/bludit/pull/1691](https://github.com/bludit/bludit/pull/1691)
- [https://www.vulncheck.com/advisories/bludit-cms-reflected-xss-via-search-plugin](https://www.vulncheck.com/advisories/bludit-cms-reflected-xss-via-search-plugin)

## Related threats

- [Bludit stored cross-site scripting in logo upload](https://junglewise.ai/threats/cve-2026-72576-bludit-stored-cross-site-scripting-in-logo-upload)
- [Bludit directory traversal in api/plugin.php](https://junglewise.ai/threats/cve-2026-50869-bludit-directory-traversal-in-api-plugin-php)
- [Bludit CMS remote code execution in API Plugin](https://junglewise.ai/threats/cve-2026-38329-bludit-cms-remote-code-execution-in-api-plugin)
- [Bludit insufficient session expiration for disabled accounts](https://junglewise.ai/threats/cve-2026-46657-bludit-insufficient-session-expiration-for-disabled-accounts)
- [Bludit CMS broken access control via ghost sessions](https://junglewise.ai/threats/cve-2026-46656-bludit-cms-broken-access-control-via-ghost-sessions)