CVE-2024-1146: Alma Blog

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

Cross-Site Scripting vulnerability in Devklan's Alma Blog that affects versions 2.1.10 and earlier. This vulnerability could allow an attacker to store a malicious JavaScript payload within the application by adding the payload to 'Community Description' or 'Community Rules'.

Affected products

• Alma Alma Blog: up to and including 2.1.10

Published 2024-03-19. Last modified 2026-06-17.