CVE-2026-24351

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24351", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2026-01-22T14:08:35.743Z", "datePublished": "2026-02-27T11:35:23.141Z", "dateUpdated": "2026-02-27T15:14:57.021Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "PluXml CMS", "vendor": "PluXml", "versions": [{"status": "affected", "version": "5.9.0-rc7", "versionType": "custom"}, {"status": "affected", "version": "5.8.21", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Arkadiusz Marta"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page.<br><br>The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.<br>"}], "value": "PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable."}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 5.1, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-02-27T11:35:23.141Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://cert.pl/posts/2026/03/CVE-2026-24350"}, {"tags": ["product"], "url": "https://pluxml.org/"}], "source": {"discovery": "EXTERNAL"}, "title": "Stored XSS in PluXml CMS", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-27T15:13:40.442740Z", "id": "CVE-2026-24351", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T15:14:57.021Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24351", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-27T15:13:40.442740Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T15:14:51.107Z"}}], "cna": {"title": "Stored XSS in PluXml CMS", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Arkadiusz Marta"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "PluXml", "product": "PluXml CMS", "versions": [{"status": "affected", "version": "5.9.0-rc7", "versionType": "custom"}, {"status": "affected", "version": "5.8.21", "versionType": "semver"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert.pl/posts/2026/03/CVE-2026-24350", "tags": ["third-party-advisory"]}, {"url": "https://pluxml.org/", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.", "supportingMedia": [{"type": "text/html", "value": "PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page.<br><br>The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2026-02-27T11:35:23.141Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24351", "state": "PUBLISHED", "dateUpdated": "2026-02-27T15:14:57.021Z", "dateReserved": "2026-01-22T14:08:35.743Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2026-02-27T11:35:23.141Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "PluXml CMS", "vendor": "PluXml", "versions": [{"status": "affected", "version": "5.9.0-rc7", "versionType": "custom"}, {"status": "affected", "version": "5.8.21", "versionType": "semver"}]}], "source": "cvd@cert.pl"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pluxml:pluxml:5.8.21:*:*:*:*:*:*:*", "matchCriteriaId": "7E8A60BA-2CCD-4CA1-85EB-C576B06084AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:pluxml:pluxml:5.9.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "7D0C04B0-AC68-4DA0-BC6B-4AED935A5C47", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page.\n\nThe vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable."}, {"lang": "es", "value": "PluXml CMS es vulnerable a XSS Almacenado en la funcionalidad de edici\u00f3n de P\u00e1ginas Est\u00e1ticas. Un atacante con privilegios de edici\u00f3n puede inyectar HTML y JS arbitrarios en el sitio web, que ser\u00e1 renderizado/ejecutado al visitar la p\u00e1gina editada.\n\nSe notific\u00f3 al proveedor con antelaci\u00f3n sobre esta vulnerabilidad, pero no respondi\u00f3 dando los detalles de la vulnerabilidad ni del rango de versiones vulnerables. Solo se probaron las versiones 5.8.21 y 5.9.0-rc7 y se confirm\u00f3 que eran vulnerables; no se probaron otras versiones por lo que tambi\u00e9n podr\u00edan ser vulnerables."}], "id": "CVE-2026-24351", "lastModified": "2026-06-17T10:22:56.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cvd@cert.pl", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24351", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-27T15:13:40.442740Z", "version": "2.0.3"}}]}, "published": "2026-02-27T12:16:03.047", "references": [{"source": "cvd@cert.pl", "tags": ["Broken Link"], "url": "https://cert.pl/posts/2026/03/CVE-2026-24350"}, {"source": "cvd@cert.pl", "tags": ["Product"], "url": "https://pluxml.org/"}], "sourceIdentifier": "cvd@cert.pl", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cvd@cert.pl", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.9.0-rc7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.8.21"}}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 87.0, "source": "matching"}]}, "original": {"product": "PluXml CMS", "source": "cna", "vendor": "PluXml"}, "product": "pluxml", "vendor": "pluxml"}], "analysis": {"en": {"generated_at": "2026-04-17T14:00:21.491457+00:00", "value": {"mitigation_remediation": ["Verify the currently installed CMS version and determine whether it equals 5.8.21 or 5.9.0\u2011rc7.", "If running a vulnerable version, upgrade to a newer release that does not contain the flaw or apply any vendor patch once it becomes available.", "Restrict who can edit static pages to a minimal set of trusted users and enforce strict input sanitization or output encoding to prevent malicious script injection."], "summary": {"action": "Assess", "impact": "Stored XSS"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the PluXml CMS platform, specifically the versions that have been confirmed to be vulnerable: 5.8.21 and 5.9.0\u2011rc7. While other releases have not been tested, they may also contain the flaw. The affected component is the static pages editing interface, which is part of the core application supplied by PluXml.", "description_and_impact": "PluXml CMS contains a stored cross\u2011site scripting flaw in the static pages editing workflow. Content editors can embed arbitrary HTML or JavaScript that is saved in the database and served unfiltered to any visitor. Because the payload is rendered as part of the page, a successful exploit enables an attacker with editing rights to execute scripts in the context of any user who views the contaminated page, potentially allowing credential theft, defacement, or malicious redirects.", "risk_and_exploitability": "The CVSS score of 5.1 indicates moderate impact, and an EPSS below 1% suggests low exploitation probability so far. The vulnerability is not currently catalogued in CISA's KEV list. Attackers need at least editing privileges to inject the payload; if such privileges are available \u2013 either through compromised accounts or mis\u2011configured access \u2013 the exploit chain is straightforward: the attacker submits malicious content, which the CMS stores and later serves to visitors. No additional network or local privilege escalation is required beyond the editing role."}}}}, "created": "2026-03-02T12:07:19.561221+00:00", "updated": "2026-04-17T14:15:21.778846+00:00", "vendors": ["pluxml", "pluxml$PRODUCT$pluxml"]}