CVE-2026-32095
Plunk has Stored Cross-Site Scripting (XSS) via SVG File Upload
CVSS Score
5.4
EPSS Score
0.0%
EPSS Percentile
0th
Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which browsers treat as active documents capable of executing embedded JavaScript, creating a stored XSS vulnerability. This vulnerability is fixed in 0.7.1.
| CWE | CWE-79 |
| Vendor | useplunk |
| Product | plunk |
| Published | Mar 11, 2026 |
| Last Updated | Mar 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for useplunk plunk
Be the first to know when new medium vulnerabilities affecting useplunk plunk are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
useplunk / plunk
< 0.7.1