A vulnerability in the Blocks Plugin of FluentCMS 0.0.5 allows remote attackers to inject malicious scripts through an unknown function in the /admin/blocks interface. The flaw can be triggered without authentication and has a publicly available exploit. Successful exploitation can lead to cross‑site scripting attacks such as session hijacking, defacement, or delivery of additional malware.

FluentCMS version 0.0.5, specifically the Blocks Plugin component. No other versions or products were identified; systems running this exact configuration are vulnerable.

The CVSS score of 4.8 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. Because the exploit is publicly available and can be invoked remotely, the likelihood of abuse is moderate to high, especially on exposed administrative interfaces.