CVE-2026-11434

2.4 LOW

A weakness has been identified in FluentCMS 0.0.5

Published: 2026-06-06 · Last updated: 2026-06-10

Severity and scoring

CVSS: 2.4 LOW
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CWE: CWE-79, CWE-94

Description

A weakness has been identified in FluentCMS 0.0.5. The impacted element is an unknown function of the file /admin/blocks of the component Blocks Plugin. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-11434
[Other]https://hackmd.io/@noka/BkHdIMFAWx
[Other]https://karinagante.github.io/cve-2026-11434/
[Other]https://karinagante.github.io/cve-2026-11434/#proof-of-concept-poc
[Other]https://vuldb.com/cve/CVE-2026-11434
[Other]https://vuldb.com/submit/821094
[Other]https://vuldb.com/vuln/369014
[Other]https://vuldb.com/vuln/369014/cti

Related CVEs

Same CWE

CVE-2025-8444 — The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based St... (6.4 MEDIUM)
CVE-2026-46518 — OpenEMR is a free and open source electronic health records and medical practice management application (7.7 HIGH)
CVE-2026-46517 — LMDeploy is a toolkit for compressing, deploying, and serving large language models (7.8 HIGH)
CVE-2026-46432 — LMDeploy is a toolkit for compressing, deploying, and serving large language models (7.8 HIGH)
CVE-2026-41003 — An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Secu... (7.6 HIGH)