The flaw exists in the Bludit CMS search plugin, where user‑supplied search terms are echoed into the page without proper escaping, allowing an unauthenticated attacker to inject arbitrary JavaScript. The result is a reflected XSS that can run when other users visit the crafted URL, enabling cookie theft or user‑context actions. This vulnerability corresponds to CWE‑79.

Affected products include Bludit CMS versions released before the security commit 6732dde. Users running those versions are susceptible; the specific affected release range is not listed, but the commit that resolves the issue is available on GitHub, and advisory references indicate that any pre‑commit version is vulnerable.

The CVSS base score of 5.1 indicates moderate severity. Because the vulnerability is user‑initiated and requires only a crafted URL, the attack surface is wide and feasible; however, the EPSS score is not available, so the current exploitation probability is unknown. The flaw is not listed in CISA KEV, but because it is reflected XSS, any user can trigger it, making it potentially impactful for session hijacking or defacement.