EUVD-2026-34969
GHSA-gp2j-q325-2c8q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A weakness has been identified in FluentCMS 0.0.5. The impacted element is an unknown function of the file /admin/blocks of the component Blocks Plugin. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Cross-site scripting in FluentCMS 0.0.5 allows a remote, highly-privileged attacker to inject malicious JavaScript via the /admin/blocks endpoint of the Blocks Plugin. The attack requires high privileges (admin-level authentication) and victim user interaction, constraining real-world impact significantly - the CVSS base score of 2.4 reflects this narrow exploitation surface. A publicly available proof-of-concept exists per HackMD, and the vendor has not responded to disclosure, leaving no official patch in place. No public exploit identified at time of analysis as reaching CISA KEV status.
Technical ContextAI
The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), meaning the application fails to adequately sanitize or encode attacker-controlled input before rendering it in the browser context. The affected component is the Blocks Plugin within FluentCMS's administrative interface, specifically the /admin/blocks file path. The CPE string cpe:2.3:a:n/a:fluentcms:*:*:*:*:*:*:*:* indicates the vendor namespace is unresolved in NVD, suggesting FluentCMS may be a smaller or community-maintained CMS project. The CVSS vector AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N confirms the XSS operates over the network but is constrained to low integrity impact with no confidentiality or availability consequences and an unchanged scope - consistent with a reflected or stored XSS limited to the admin panel context.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to the initial disclosure, and no fix version appears in the referenced advisories (https://vuldb.com/vuln/369014). As a compensating control, restrict access to the /admin/blocks endpoint to the minimum number of trusted administrators using network-level ACLs or web application firewall rules blocking unauthenticated and lower-privileged access to admin panel routes. Implementing a Content Security Policy (CSP) header on the admin interface to disallow inline script execution can reduce the impact of any successful XSS injection, though it does not eliminate the root cause. Output encoding middleware or a patched fork of the Blocks Plugin would address the root cause if the upstream project remains unresponsive. Monitor the VulDB entry at https://vuldb.com/cve/CVE-2026-11434 for any future vendor response or patch release.
FluentCMS 2026 contains a stored cross-site scripting vulnerability that allows authenticated administrators to upload S
Missing authorization in FluentCMS's permission-management layer allows network-accessible, high-privileged users to byp
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today