PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-24351 PluXml CVE debrief

A stored cross-site scripting (XSS) vulnerability in PluXml CMS allows authenticated users with editing privileges to inject arbitrary HTML and JavaScript into static pages. The malicious content executes when visitors access the compromised page. The vulnerability was disclosed to the vendor without response regarding affected version ranges. Testing confirmed exploitation in versions 5.8.21 and 5.9.0-rc7; other versions remain untested but may be vulnerable. The issue was published to CVE on February 27, 2026, with metadata updated on May 19, 2026. No known exploitation in ransomware campaigns has been documented.

Vendor
PluXml
Product
PluXml CMS
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-27
Original CVE updated
2026-05-19
Advisory published
2026-02-27
Advisory updated
2026-05-19

Who should care

Organizations running PluXml CMS with multiple content editors or untrusted administrative users; security teams monitoring for stored XSS in content management systems; web administrators responsible for CMS hardening and access control.

Technical summary

The vulnerability exists in the static page editing functionality of PluXml CMS. Authenticated users with editing capabilities can inject arbitrary HTML and JavaScript that persists in stored content. When visitors access the edited page, the injected scripts execute in their browser context. The attack requires low attack complexity, network access, and low privileges, with user interaction required for exploitation. The vulnerability affects confidentiality and integrity with low severity impact per CVSS 4.0 scoring.

Defensive priority

medium

Recommended defensive actions

  • Apply input validation and output encoding for all user-supplied content in static page editing interfaces
  • Implement Content Security Policy (CSP) headers to mitigate impact of injected scripts
  • Review and restrict editing privileges to trusted administrative users only
  • Monitor for unauthorized static page modifications in access logs
  • Consider Web Application Firewall (WAF) rules targeting script injection patterns in CMS content fields
  • Test patch availability from the vendor for versions 5.8.21 and 5.9.0-rc7, and evaluate upgrade paths for untested versions

Evidence notes

Confirmed vulnerable versions: 5.8.21, 5.9.0-rc7. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N. CWE-79 (Improper Neutralization of Input During Web Page Generation). Source references include a broken CERT.PL link and the vendor product page.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-24351 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-24351

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-24351 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-24351

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.