A weakness in Bolt CMS allows manipulation of the style argument in the TextType.php component, leading to unsanitized HTML injection. This flaw enables an attacker to inject arbitrary HTML attributes, which can in turn trigger cross‑site scripting or other client‑side attacks when the injected content is rendered. The description states that the attack can be launched remotely, and an exploit is publicly available, indicating that the vulnerability is already weaponised.

Bolt CMS versions up to and including 3.7.5 are affected. This includes all releases that are no longer maintained by the vendor. No specific sub‑plugins or modules are singled out, so any installation of the vulnerable version that uses the HTML Attribute Handler is at risk.

The CVSS score of 5.1 classifies the vulnerability as medium severity. EPSS data is not available and the flaw is not listed in CISA’s KEV catalog. Because the exploit can be performed remotely and is already in the public domain, the likelihood of real‑world exploitation is higher than the internal metrics might suggest. Effective exploitation requires the ability to supply crafted input to the style field, which can often be achieved via normal user interactions or API calls within the CMS interface.