CVE-2026-24351
Stored XSS in PluXml CMS
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
| CWE | CWE-79 |
| Vendor | pluxml |
| Product | pluxml cms |
| Published | Feb 27, 2026 |
| Last Updated | Feb 27, 2026 |
Stay Ahead of the Next One
Get instant alerts for pluxml pluxml cms
Be the first to know when new unknown vulnerabilities affecting pluxml pluxml cms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
PluXml / PluXml CMS
5.9.0-rc7 5.8.21
References
Credits
Arkadiusz Marta