https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-4420.htmlhttps://patchthecve.com/cve/CVE-2026-4420.htmlWed, 17 Jun 2026 10:56:32 +0000MEDIUM 5.4: Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its page creating functionality. An authenticated attacker with page creation privileges (such as Author, Editor, or Administrator) can embed a malicious JavaScript payload in the tags field of a newly created article. This payload will behttps://patchthecve.com/cve/CVE-2026-25101.htmlhttps://patchthecve.com/cve/CVE-2026-25101.htmlWed, 17 Jun 2026 10:24:06 +0000CRITICAL 9.8: Bludit allows user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behavior enables an attacker to fix a session ID for a victim and later hijack the authenticated session. This issue was fixed in version 3.17.2.https://patchthecve.com/cve/CVE-2026-25100.htmlhttps://patchthecve.com/cve/CVE-2026-25100.htmlWed, 17 Jun 2026 10:24:06 +0000MEDIUM 5.4: Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker with content upload privileges (such as Author, Editor, or Administrator) can upload an SVG file containing a malicious payload, which is executed when a victim visits the URL of thhttps://patchthecve.com/cve/CVE-2026-25099.htmlhttps://patchthecve.com/cve/CVE-2026-25099.htmlWed, 17 Jun 2026 10:24:06 +0000HIGH 8.8: Bludit’s API plugin allows an authenticated attacker with a valid API token to upload files of any type and extension without restriction, which can then be executed, leading to Remote Code Execution. This issue was fixed in 3.18.4.