CVE-2016-7140: Cross-Site Scripting (XSS) Vulnerabilities in Plone CMS
Summary
CVE-2016-7140: Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via u... Affects plone across 3 version ranges.
>= 3.3, < 4.0a1
>= 4.0, < 4.3.12
>= 5.0, < 5.0.7
Fixed in 4.0a1, 4.3.12 or 5.0.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Plone CMS is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites. Plone CMS versions 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 are affected by multiple cross-site scripting (XSS) vulnerabilities.
Vulnerability Detail
The identified XSS vulnerabilities exist in the ZMI (Zope Management Interface) page of Plone CMS. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML into the application. The specific vectors through which the injection can occur are not disclosed in the vulnerability details. However, it is important to note that successful exploitation of these vulnerabilities can lead to various security risks, including unauthorized access, data theft, and potential compromise of user accounts.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.3, < 4.0a14.0a1pip install --upgrade "plone==4.0a1" -
>= 4.0, < 4.3.124.3.12pip install --upgrade "plone==4.3.12" -
>= 5.0, < 5.0.75.0.7pip install --upgrade "plone==5.0.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround is mentioned in the vulnerability details. However, as a general best practice, it is advisable to implement input validation and output encoding to mitigate the risk of XSS attacks. Developers should sanitize user input and properly encode output to prevent the execution of malicious scripts or HTML.
Conclusion
The identified cross-site scripting (XSS) vulnerabilities in Plone CMS can pose significant security risks. It is crucial to upgrade to the fixed versions of Plone CMS to ensure a secure environment for the application. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone CMS is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites.
Plone CMS versions 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 are affected by these cross-site scripting (XSS) vulnerabilities.
Successful exploitation of these vulnerabilities can lead to unauthorized access, data theft, and potential compromise of user accounts.
To fix the XSS vulnerabilities, it is recommended to upgrade to the fixed versions of Plone CMS. For specific version information, refer to the 'how_to_fix' section of this report.
No specific workaround is mentioned in the vulnerability details. However, implementing input validation and output encoding can help mitigate the risk of XSS attacks.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
