CVE-2016-7147: Cross-Site Scripting (XSS) in Plone
Summary
CVE-2016-7147: Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via... Affects plone across 2 version ranges.
< 4.3.12
>= 5.0, < 5.0.7
Fixed in 4.3.12 or 5.0.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and search functionality. Plone versions before 4.3.12 and 5.x before 5.0.7 are affected by a cross-site scripting vulnerability in the search feature of the Zope ZMI (Zope Management Interface).
Vulnerability Detail
The vulnerability allows remote attackers to inject arbitrary web script or HTML through the search feature in the Zope ZMI. Specifically, the issue arises due to improper handling of double quotes in the obj_ids:tokens parameter. This vulnerability is a result of an incomplete fix for CVE-2016-7140. An attacker can exploit this vulnerability to execute malicious scripts or steal sensitive information from users who visit the affected Plone site.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.3.124.3.12pip install --upgrade "plone==4.3.12" -
>= 5.0, < 5.0.75.0.7pip install --upgrade "plone==5.0.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the search feature in the Zope ZMI or implement input validation and output encoding to mitigate the risk of XSS attacks. Here is an example of input validation using Python and the cgi.escape function:
import cgi
input_data = get_user_input()
escaped_data = cgi.escape(input_data)
This will escape any special characters in the user input, preventing them from being interpreted as HTML or script code.
Conclusion
The cross-site scripting vulnerability in Plone's Zope ZMI search feature can allow remote attackers to inject malicious scripts or HTML into the affected site. To mitigate this risk, users should update their Plone installations to version 4.3.12 or 5.0.7, which include the necessary patches. Additionally, implementing input validation and output encoding can provide temporary protection. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
The vulnerability allows attackers to inject malicious scripts or HTML into the affected Plone site, potentially leading to the theft of sensitive information or the execution of unauthorized actions on behalf of the user.
No, only Plone versions before 4.3.12 and 5.x before 5.0.7 are vulnerable. It is recommended to update to the latest available version to mitigate the risk.
While there is no specific known exploit available, the vulnerability is considered critical and should be addressed promptly to prevent potential attacks.
Yes, remote attackers can exploit this vulnerability by sending specially crafted requests to the affected Plone site.
Yes, patches have been released in Plone versions 4.3.12 and 5.0.7 to fix this vulnerability. It is recommended to update to these versions or newer.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
