CVE-2026-4420 — Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its page creating…
Image via cert.pl
🚨 CVE-2026-4420 Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its page creating functionality. An authenticated attacker with page creation privileges (such as Author, Editor, or Administrator) can embed a malicious JavaScript payload in the tags field of a newly created article. Thi
What This Means For You
- Rated critical severity — prioritize patching or mitigation.
- New vulnerability disclosed — verify if your stack is exposed.
Related ATT&CK Techniques
🛡️ Detection Rules
1 rule · 6 SIEM formats1 detection rule mapped to MITRE ATT&CK. Free Sigma YAML below.
Web Application Exploitation Attempt — CVE-2026-4420
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-4420 | XSS | Software: Bludit, Versions: 3.17.2, 3.18.0, Vulnerable Component: Page creating functionality, specifically the 'tags' field of a newly created article. |
| CVE-2026-4420 | Privilege Escalation | Software: Bludit, Versions: 3.17.2, 3.18.0, Vulnerable Component: Page creating functionality, specifically the 'tags' field of a newly created article. Exploitation can lead to automatic creation of a new site administrator if the victim has sufficient privileges. |
Source & Attribution
| Source Platform | Telegram |
| Channel | CVE Notify |
| Published | April 07, 2026 at 14:26 UTC |
This content was curated and summarized by Shimi's Cyber World for informational purposes. It is not copied or republished in full. All intellectual property rights remain with the original author and source.
Believe this infringes your rights? Submit a takedown request.
Related coverage
Huawei Router Flaw Triggered Telecom Blackout, SecurityWeek Reports
SecurityWeek reports on a critical flaw in Huawei routers that led to a significant telecom blackout. While details are sparse, the incident underscores the inherent...
WordPress Ditty Plugin: Authorization Bypass Exposes Non-Public Content
CVE-2026-9011 — The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and...
CVE-2026-8692 — The Vedrixa Forms – User Registration Form, Signup Form &
CVE-2026-8692 — The Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder plugin for WordPress is vulnerable to authorization bypass...