PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24351 PluXml CVE debrief

A stored cross-site scripting (XSS) vulnerability in PluXml CMS allows authenticated users with editing privileges to inject arbitrary HTML and JavaScript into static pages. The malicious content executes when visitors access the compromised page. The vulnerability was disclosed to the vendor without response regarding affected version ranges. Testing confirmed exploitation in versions 5.8.21 and 5.9.0-rc7; other versions remain untested but may be vulnerable. The issue was published to CVE on February 27, 2026, with metadata updated on May 19, 2026. No known exploitation in ransomware campaigns has been documented.

Vendor
PluXml
Product
PluXml CMS
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-27
Original CVE updated
2026-05-19
Advisory published
2026-02-27
Advisory updated
2026-05-19

Who should care

Organizations running PluXml CMS with multiple content editors or untrusted administrative users; security teams monitoring for stored XSS in content management systems; web administrators responsible for CMS hardening and access control.

Technical summary

The vulnerability exists in the static page editing functionality of PluXml CMS. Authenticated users with editing capabilities can inject arbitrary HTML and JavaScript that persists in stored content. When visitors access the edited page, the injected scripts execute in their browser context. The attack requires low attack complexity, network access, and low privileges, with user interaction required for exploitation. The vulnerability affects confidentiality and integrity with low severity impact per CVSS 4.0 scoring.

Defensive priority

medium

Recommended defensive actions

  • Apply input validation and output encoding for all user-supplied content in static page editing interfaces
  • Implement Content Security Policy (CSP) headers to mitigate impact of injected scripts
  • Review and restrict editing privileges to trusted administrative users only
  • Monitor for unauthorized static page modifications in access logs
  • Consider Web Application Firewall (WAF) rules targeting script injection patterns in CMS content fields
  • Test patch availability from the vendor for versions 5.8.21 and 5.9.0-rc7, and evaluate upgrade paths for untested versions

Evidence notes

Confirmed vulnerable versions: 5.8.21, 5.9.0-rc7. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N. CWE-79 (Improper Neutralization of Input During Web Page Generation). Source references include a broken CERT.PL link and the vendor product page.

Official resources

The vulnerability was reported to the vendor prior to publication, but the vendor did not provide details on the vulnerability or confirm the vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed vulnerable.