HTML Injection Vulnerability in Bolt CMS by Bolt
CVE-2026-11511

5.1MEDIUM

Key Information:

Vendor

Bolt

Status
Cms
Vendor
CVE Published:
8 June 2026

What is CVE-2026-11511?

A vulnerability has been identified in Bolt CMS versions up to 3.7.5, where improper handling of the argument in the HTML Attribute Handler's code can result in HTML injection. This issue allows remote attackers to manipulate web page elements by injecting malicious scripts into attributes, posing a significant risk to affected sites. The exploit has been publicly disclosed, emphasizing the need for immediate attention to these outdated products that lack ongoing support from the developer.

Affected Version(s)

CMS 3.7.0

CMS 3.7.1

CMS 3.7.2

References

https://vuldb.com/vuln/369131
vdb-entrytechnical-description
https://vuldb.com/vuln/369131/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-11511
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

geochen (VulDB User)
VulDB CNA Team
.