Bludit allows authenticated users with page‑creation rights to insert arbitrary JavaScript into the tags field of a newly created article. Because the tags field is rendered without escaping, the script runs in any browser that opens the article’s URL, creating a classic stored XSS. An attacker can abuse this to steal session cookies, deface the site, execute arbitrary actions on behalf of the victim, or, if the victim possesses higher‑level administrative privileges, automatically create a new administrator account.

The vulnerability has been verified on Bludit versions 3.17.2 and 3.18.0. Other releases were not formally tested but are suspected to be affected as well, so any site running versions from this range should be treated as at risk.

The CVSS score of 5.1 indicates moderate severity. Because the exploit requires an authenticated account with article‑creation rights, the risk is limited to sites with loose permission controls or where attackers can compromise a low‑privilege user. The missing EPSS data and absence from the KEV catalog suggest exploitation is not yet widespread, but the potential to elevate privileges by auto‑creating an administrator elevates the threat level for sites with exposed vulnerable functionality.