CVE-2012-5494: Cross-Site Scripting (XSS) Vulnerability in Plone
Summary
CVE-2012-5494: Plone Cross-site scripting Vulnerability. Affects plone across 2 version ranges.
< 4.2.3
>= 4.3a0, < 4.3b1
Fixed in 4.2.3 or 4.3b1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a flexible and extensible platform for creating and managing websites. Plone is written in Python and is widely used for various web applications. However, versions before 4.2.3 and 4.3 before beta 1 are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability exists in the python_scripts.py file of Plone, allowing remote attackers to inject arbitrary web script or HTML through unspecified vectors related to "{u,}translate." This can lead to the execution of malicious code in the context of the affected user's browser, potentially compromising sensitive information or performing unauthorized actions.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.2.34.2.3pip install --upgrade "plone==4.2.3" -
>= 4.3a0, < 4.3b14.3b1pip install --upgrade "plone==4.3b1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a newer version of Plone is not immediately feasible, a temporary workaround is to sanitize user input and properly encode any dynamic content displayed on the website. This can be achieved by using appropriate security libraries or frameworks that handle input validation and output encoding.
Conclusion
The cross-site scripting (XSS) vulnerability in Plone before version 4.2.3 and 4.3 beta 1 can allow remote attackers to inject malicious scripts or HTML into web pages. To mitigate this vulnerability, it is crucial to upgrade to the latest version of Plone or apply the recommended security measures. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information, session hijacking, or defacing websites.
By exploiting this vulnerability, an attacker can craft malicious input that, when executed by a user's browser, executes arbitrary code within the context of the affected website. This can be used to steal sensitive information, perform unauthorized actions, or manipulate the website's content.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the recommended fixes promptly to mitigate the risk of exploitation.
No, only versions before 4.2.3 and 4.3 before beta 1 are vulnerable to this specific XSS vulnerability. It is important to keep the software up to date to ensure the latest security patches are applied.
For more information about this vulnerability, you can refer to the official advisory provided by the Plone development team. The advisory contains detailed information about the vulnerability, its impact, and the recommended steps to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
