CVE-2026-27742: Bludit <= 3.16.2 Stored XSS in Post Content
Bludit version 3.16.2 contains a stored cross-site scripting (XSS) vulnerability in the post content functionality. The application performs client-side sanitation of content input but does not enforce equivalent sanitation on the server side. An authenticated user can inject arbitrary JavaScript into the content field of a post, which is stored and later rendered to other users without proper output encoding. When viewed, the injected script executes in the context of the victim’s browser, allowing session hijacking, credential theft, content manipulation, or other actions within the user’s privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27742?
CVE-2026-27742 is classified as a medium severity stored XSS vulnerability.
How do I fix CVE-2026-27742?
To fix CVE-2026-27742, upgrade Bludit to version 3.16.3 or later which addresses the stored XSS issue.
What impact does CVE-2026-27742 have on Bludit users?
CVE-2026-27742 allows attackers to inject malicious scripts into post content, potentially compromising user sessions and data.
Who is vulnerable to CVE-2026-27742?
All users of Bludit versions 3.16.2 and earlier are vulnerable to CVE-2026-27742.
Is there a workaround for CVE-2026-27742 before upgrading Bludit?
A workaround for CVE-2026-27742 is to disable the post content editing feature until an upgrade can be performed.