Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
Aug 5, 2026Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase.CVE-2026-71291 · Other software · bolt · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.8
Bolt CMS renders content field values through Twig's full application-level Environment with no SandboxExtension registered anywhere in the codebase. In src/Entity/Field.php, getTwigValue calls shouldBeRenderedAsTwig, which gates rendering only on the field definition's allow_twig flag and a regex checking for , , or ; when true, the raw field value is compiled and rendered via with no sandboxing.
- Product
- core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2026A weakness has been identified in Bolt CMS up to 3.7.5.CVE-2026-11511 · Other software · Bolt · reported by VulDBLow 2
A weakness has been identified in Bolt CMS up to 3.7.5. This vulnerability affects unknown code of the file src/Storage/Field/Type/TextType.php of the component HTML Attribute Handler. Executing a manipulation of the argument style can lead to HTML injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The GitHub repository was archived by the owner and is now read-only. This vulnerability only affects products that are no longer supported by the maintainer.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages.CVE-2026-39229 · Other software · reported by MITREMedium 6.5
Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated attacker with low-level privileges can exploit this through the OrderDirective component. This allows for the extraction of sensitive information
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2025Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution.CVE-2025-34086 · Other software · Bolt · reported by VulnCheckHigh 7.5
Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend templates. The attacker can then list and rename cached session files via the /async/browse/cache/.sessions and /async/folder/rename endpoints. By renaming a .session file to a path under the publicly accessible /files/ directory with a .php extension, the attacker can turn the injected code into an executable web shell. Finally, the attacker triggers the payload via a crafted HTTP GET request to the rogue file. NOTE: The vendor announced that Bolt 3 reached end-of-life after 31 December 2021.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024A vulnerability classified as problematic has been found in Bolt CMS 3.7.1.CVE-2024-7300 · Other software · Bolt · reported by VulDBMedium 5.3
A vulnerability classified as problematic has been found in Bolt CMS 3.7.1. Affected is an unknown function of the file /bolt/editcontent/showcases of the component Showcase Creation Handler. The manipulation of the argument title/textarea leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2024** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Bolt CMS 3.7.1.CVE-2024-7299 · Other software · Bolt · reported by VulDBMedium 5.3
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Bolt CMS 3.7.1. It has been rated as problematic. This issue affects some unknown processing of the file /preview/page of the component Entry Preview Handler. The manipulation of the argument body leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-273167. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the affected release tree is end-of-life.
- Product
- CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2022Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an authenticated user with the ROLE_EDITOR privileges to upload and rename a maliciousCVE-2022-36532 · Other software · Bolt · reported by MITREHigh 8.8
Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an authenticated user with the ROLE_EDITOR privileges to upload and rename a malicious file to achieve remote code execution.
- Product
- Bolt CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlutrasecurity.comlutrasecurity.com
Apr 11, 2022Bolt CMS <= 4.2 is vulnerable to Remote Code Execution.CVE-2021-40219 · Other software · Bolt · reported by MITREHigh 8.8
Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution.
- Product
- Bolt CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 8, 2020In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS.CVE-2020-4041 · Other software · bolt · reported by GitHubHigh 7.4
In Bolt CMS before version 3.7.1, the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But, once created/uploaded, it can be renamed to inject the payload in it. Additionally, the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.
- Product
- bolt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 8, 2020Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint.CVE-2020-4040 · Other software · bolt · reported by GitHubHigh 8.6
Bolt CMS before version 3.7.1 lacked CSRF protection in the preview generating endpoint. Previews are intended to be generated by the admins, developers, chief-editors, and editors, who are authorized to create content in the application. But due to lack of proper CSRF protection, unauthorized users could generate a preview. This has been fixed in Bolt 3.7.1
- Product
- bolt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Apr 5, 2019Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaCVE-2019-10874 · Other software · Boltcms · reported by MITREHigh 8.8
Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file.
- Product
- Bolt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comfgsec.net
Dec 17, 2018Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.CVE-2018-19933 · Other software · Bolt · reported by MITREMedium 6.1
Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.
- Product
- Bolt CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comexploit-db.com
Jul 17, 2017Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry.CVE-2017-11128 · Other software · Boltcms · reported by MITREMedium 5.4
Bolt CMS 3.2.14 allows stored XSS via text input, as demonstrated by the Title field of a New Entry.
- Product
- Bolt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwebsecnerd.blogspot.inwebsecnerd.blogspot.in
Jul 17, 2017Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header.CVE-2017-11127 · Other software · Boltcms · reported by MITREMedium 5.4
Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header.
- Product
- Bolt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwebsecnerd.blogspot.inwebsecnerd.blogspot.in
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.