CVE-2026-24351

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-24351
PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://cert.pl/posts/2026/03/CVE-2026-24350 Broken Link
https://pluxml.org/ Product
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:pluxml:pluxml:5.8.21:*:*:*:*:*:*:*
cpe:2.3:a:pluxml:pluxml:5.9.0:rc7:*:*:*:*:*:*
History

19 May 2026, 22:15

Type Values Removed Values Added
CPE cpe:2.3:a:pluxml:pluxml:5.8.9:rc7:*:*:*:*:*:* cpe:2.3:a:pluxml:pluxml:5.9.0:rc7:*:*:*:*:*:*
Summary
  • (es) PluXml CMS es vulnerable a XSS Almacenado en la funcionalidad de edición de Páginas Estáticas. Un atacante con privilegios de edición puede inyectar HTML y JS arbitrarios en el sitio web, que será renderizado/ejecutado al visitar la página editada. Se notificó al proveedor con antelación sobre esta vulnerabilidad, pero no respondió dando los detalles de la vulnerabilidad ni del rango de versiones vulnerables. Solo se probaron las versiones 5.8.21 y 5.9.0-rc7 y se confirmó que eran vulnerables; no se probaron otras versiones por lo que también podrían ser vulnerables.

27 Feb 2026, 18:34

Type Values Removed Values Added
CPE cpe:2.3:a:pluxml:pluxml:5.8.21:*:*:*:*:*:*:*
cpe:2.3:a:pluxml:pluxml:5.8.9:rc7:*:*:*:*:*:*
First Time Pluxml pluxml
Pluxml
References () https://cert.pl/posts/2026/03/CVE-2026-24350 - () https://cert.pl/posts/2026/03/CVE-2026-24350 - Broken Link
References () https://pluxml.org/ - () https://pluxml.org/ - Product
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4

27 Feb 2026, 12:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-27 12:16

Updated : 2026-05-19 22:15

NVD link : CVE-2026-24351

Mitre link : CVE-2026-24351

CVE.ORG link : CVE-2026-24351

JSON object : View

Products Affected

pluxml

  • pluxml
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')