CVE-2018-19933

Bolt Cross-site Scripting (XSS) via text input click preview button

6.1 MediumPublic exploitFix available

Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

3.47%Down 0.2 points since Apr 14, 2021

What each source reports

NVD Score used 6.1

Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.

Record: CVE-2018-19933
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.

Record: CVE-2018-19933
Updated: 2026-11-02

EUVDEUVD-2022-3972 No score

Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.

Record: EUVD-2022-3972
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gjx6-58xh-p7pw 6.1

Bolt Cross-site Scripting (XSS) via text input click preview button

Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.

Record: GHSA-gjx6-58xh-p7pw
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.

Record: CVE-2018-19933
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-gjx6-58xh-p7pw 6.1

Bolt Cross-site Scripting (XSS) via text input click preview button

Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.

Record: GHSA-gjx6-58xh-p7pw
CVSS 3.0: 6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

bolt cms

Affected packages

Affected packages
Package	Affected	Fixed
`bolt/bolt` Packagist	before 3.6.2	3.6.2
`bolt/bolt` Packagist	before 3.6.2, plus listed versions 3.5.7v0.8.4v0.8.5v0.9.10v0.9.5 Show 45 moreShow less v1.0.0v1.0.5v1.1.2v1.1.4v1.2.1v1.3.0v1.4.0v1.4.3v1.5.1v1.5.6v1.6.0v1.6.2v1.6.3v1.6.3.1v1.6.9v2.0.0v2.0.1v2.0.2v2.0.3v2.0.4v2.0.5v2.0.6v2.1.0v2.1.1v2.1.1-pl1v2.1.2v2.1.3v2.1.3-pl1v2.1.4v2.1.4-pl1v2.1.5v2.1.6v2.1.7v2.1.8v2.1.8-pl1v2.1.9v2.2.0v2.2.1v2.2.10v2.2.11v2.2.13v2.2.14v2.2.15v2.2.16v2.2.17	3.6.2

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Bolt CMS < 3.6.2 - Cross-Site Scripting	2018-12-19

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-19933 is a medium vulnerability (CVSS 6.1) in Bolt Cms, published December 17, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.47%, the 89th percentile. Fixed in bolt/bolt 3.6.2.

References

This page doesn't list everything

Left out here: 93 versions. The JSON record has them.