A stored cross‑site scripting flaw allows a low‑privileged authenticated user with Author role to upload a specially crafted SVG file to the /admin/ajax/logo‑upload endpoint. The code moves the file directly to the web root without sanitization, so any embedded <script> tag runs in the browser of any visitor who loads the logo. This enables arbitrary JavaScript execution on user browsers, enabling defacement, credential theft or other client‑side attacks. The weakness is classified as CWE‑79.

Bludit Bludit 4.0.0‑beta is affected. No other product or version information is provided.

The CVSS score of 5.4 indicates moderate severity; EPSS is not available and the vulnerability is not listed in CISA KEV. The attack requires the user to be authenticated as an Author, which is a relatively low privilege but still attainable by many site contributors. Because the flaw is a stored XSS, its impact depends on the number and type of visitors who view the logo, but any such user is exposed. Exploitation is straightforward once the user supplies an SVG upload; no additional network or privilege escalation steps are needed.