Bolt CMS CVE-2026-11511

Q: What is the CVSS score of CVE-2026-11511?

CVE-2026-11511 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-35059 LOW

Basic XSS (CWE-80)

2026-06-08 VulDB

GHSA-wr9m-77f5-2xp5

PHP XSS

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:52 vuln.today

CVSS changed

Jun 08, 2026 - 13:22 NVD

3.5 (LOW) 2.0 (LOW)

DescriptionCVE.org

A weakness has been identified in Bolt CMS up to 3.7.5. This vulnerability affects unknown code of the file src/Storage/Field/Type/TextType.php of the component HTML Attribute Handler. Executing a manipulation of the argument style can lead to HTML injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The GitHub repository was archived by the owner and is now read-only. This vulnerability only affects products that are no longer supported by the maintainer.

AnalysisAI

HTML injection in Bolt CMS 3.7.5 and earlier allows authenticated remote attackers to inject arbitrary HTML by manipulating the style argument within the HTML Attribute Handler component (src/Storage/Field/Type/TextType.php). The vulnerability requires low-privilege credentials and passive victim interaction for injected content to render, producing low-severity but persistent integrity exposure. Publicly available exploit code exists (CVSS E:P confirmed), and because the project repository has been archived as read-only by the maintainer, no vendor patch will ever be released - any remaining deployment faces permanent unpatched exposure.

Technical ContextAI

Bolt CMS is a PHP-based content management system. The vulnerable component is the HTML Attribute Handler within src/Storage/Field/Type/TextType.php, responsible for processing field-level type data during content storage. CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page) identifies the root cause as insufficient sanitization or output encoding of user-supplied input - specifically the style argument - before it is written into an HTML rendering context. This allows an attacker to inject raw HTML markup, including style-based payloads, CSS expression constructs, or adjacent script-triggering tags depending on browser handling. The CPE string cpe:2.3:a:bolt:cms:*:*:*:*:*:*:*:* covers all releases up to and including 3.7.5. The XSS tag assigned by VulDB aligns with CWE-80's scope, which encompasses basic HTML and script injection beyond just classic reflected XSS.

RemediationAI

No vendor-released patch will be provided - the Bolt CMS repository has been archived and is permanently read-only, making this an unresolvable vulnerability within the existing product lineage. The primary remediation is migration to an actively maintained CMS platform; this is the only complete fix available. For organizations where immediate migration is not feasible, the following specific compensating controls are recommended: first, restrict write access to affected content fields exclusively to highly trusted administrator-level roles, eliminating the PR:L attack surface from lower-privilege contributors (trade-off: reduces editorial workflow flexibility); second, deploy a Web Application Firewall rule to strip or encode style attribute values submitted through CMS input forms (trade-off: may break legitimate inline styling workflows and requires ongoing rule maintenance); third, enforce a strict Content Security Policy header on served pages - for example style-src 'self' - to limit the browser-side impact of injected style payloads (trade-off: breaks third-party embedded stylesheets). Reference VulDB advisory at https://vuldb.com/vuln/369131 for additional technical detail.