CVE-2026-11511mediumCWE-74CWE-80

CVE-2026-11511: medium-severity vulnerability in Bolt CMS

Bolt CMS HTML Attribute TextType.php HTML injection

Published

Follow this CVE+ Monitor CMS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.2%
A weakness has been identified in Bolt CMS up to 3.7.5. This vulnerability affects unknown code of the file src/Storage/Field/Type/TextType.php of the component HTML Attribute Handler. Executing a manipulation of the argument style can lead to HTML injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The GitHub repository was archived by the owner and is now read-only. This vulnerability only affects products that are no longer supported by the maintainer.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
Bolt · CMS
Related CVEs — Bolt CMS

In the same product, most dangerous first.

CVE-2025-34086HIGHBolt CMS Authenticated Remote Code Execution via Profile Injection and File RenameEPSS 4.3%CVE-2024-7300MEDIUMBolt CMS Showcase Creation showcases cross site scriptingEPSS 0.4%CVE-2024-7299MEDIUMBolt CMS Entry Preview page cross site scriptingEPSS 0.4%