Bludit version 3.16.2 includes a stored cross‑site scripting flaw that allows an authenticated user to inject arbitrary JavaScript into the post content field. The application only sanitizes input on the client side and fails to apply equivalent server‑side filtering or output encoding. When another user views the post, the malicious script executes in the victim’s browser, giving the attacker the ability to hijack the session, steal credentials, or modify content within the victim’s privileges. This represents a typical CWE‑79 vulnerability involving unsanitized reflected input rendered as HTML.

The affected product is the Bludit content management system, specifically any installation running version 3.16.2 or earlier. No other vendors or product variants are listed as impacted, and the issue originates from the post‑content handling logic within the CMS core.

The CVSS base score of 5.1 indicates a moderate risk, and the EPSS score of less than 1% points to a very low likelihood of exploitation in the wild at the time of this assessment. The vulnerability is not currently listed in the CISA Key Exploited Vulnerabilities catalog. The attack vector is a stored XSS that requires an authenticated user to insert malicious payloads; once an attacker creates a post containing the script, any unprivileged user who views that post will be exposed.