THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-72576 (MEDIUM 5.4) — A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who

[NVD] CVE-2026-72576 (MEDIUM 5.4) — A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who

mednvdPublished 2026-08-10

CVE-2026-72576 CVSS: 5.4 MEDIUM Published: 2026-08-10T11:17:30.407

A stored cross-site scripting (XSS) vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user (Author role) to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo.

MITRE ATT&CK techniques

JavaScriptT1059.007

Indicators of compromise

CVE-2026-72576cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-72576