CVE-2026-24351
Plain English Summary
AI-powered analysis for quick understanding
An attacker with editing privileges on a PluXml CMS website can inject malicious HTML and JavaScript into static pages, which will run whenever someone visits those pages. This means they could steal user data or perform actions on behalf of visitors without their consent.
Technical Description
PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVSS Vector Analysis
Vector String
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XExploit Resources
Search for proof-of-concept code and exploit modules
Official References
Quick Information
Published
Feb 27, 2026
about 1 month ago
Last Modified
Feb 27, 2026
about 1 month ago
Vendor
pluxml
Product
pluxml
Related Vulnerabilities
This vulnerability allows an attacker to take control of a victim's session by setting a fixed session ID before the victim logs in, which can lead to session hijacking. The attacker needs to know or guess the session ID, and it has been confirmed in specific versions of the PluXml CMS, but other versions may also be at risk.
This vulnerability allows an attacker to upload a malicious SVG file to a PluXml CMS site, which can then execute harmful code when a victim directly accesses the file. The attacker needs to be authenticated to upload the file, and while the link to the image may not trigger the attack, accessing the file directly will still run the malicious code.