CVE-2026-24351CWE-79

Stored XSS in PluXml CMS

Medium · published February 27, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
7.6
In the wild
Unconfirmed
What it is

PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page.

The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00184 · 7.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-02-27T11:35Z
EPSS history
Timeline
  • 27 FEB 11:35Z
    Stored XSS in PluXml CMS
    cvelistv5