What is CVE-2026-11511?

CVE-2026-11511 is a low-severity vulnerability in Bolt Cms, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 3.5/10. Published 2026-06-08.

How severe is CVE-2026-11511?

Low severity. CVSS v3 base score is 3.5 out of 10.

XSS in Bolt Cms

CVE-2026-11511

A weakness has been identified in Bolt CMS up to 3.7.5. This vulnerability affects unknown code of the file src/Storage/Field/Type/TextType.php of the component HTML Attribute Handler. Executing a manipulation of the argument style can lead to HTML injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The GitHub repository was archived by the owner and is now read-only. This vulnerability only affects products that are no longer supported by the maintainer.

EPSS: 0.002 (8.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N.

Affected products

Bolt Cms — versions 3.7.0, 3.7.1, 3.7.2

Weakness classification (CWE)

References

cna@vuldb.com (third-party-advisory)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (technical-description, vdb-entry)
cna@vuldb.com (signature, permissions-required)

Frequently asked questions

What is CVE-2026-11511?: CVE-2026-11511 is a low-severity vulnerability in Bolt Cms, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 3.5/10. Published 2026-06-08.
How severe is CVE-2026-11511?: Low severity. CVSS v3 base score is 3.5 out of 10.