CVE-2021-3313: Stored Cross-Site Scripting (XSS) in Plone CMS
Summary
CVE-2021-3313: Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. Affects plone versions < 5.2.4. Fixed in 5.2.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone CMS is an open-source content management system written in Python. It provides a robust platform for building websites, intranets, and web applications. Plone CMS allows users to create and manage content, including user profiles and file uploads. However, versions prior to 5.2.4 are vulnerable to a stored Cross-Site Scripting (XSS) attack.
Vulnerability Detail
The stored XSS vulnerability in Plone CMS arises from improper encoding of user input data in the user fullname property and the file upload functionality. When this data is echoed back to the user, it is not properly encoded, allowing it to be interpreted as executable code by the victim's browser. An attacker can exploit this vulnerability by injecting malicious JavaScript code, which will be executed in the context of the victim's browser when they open a vulnerable page containing an XSS payload. This can lead to various consequences, such as session hijacking, defacement of web pages, or theft of sensitive information.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.4
This is the first release that contains the fix.
pip install --upgrade "plone==5.2.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by sanitizing user input data before echoing it back to the user. This can be achieved by using appropriate encoding functions or libraries to ensure that any potentially malicious code is treated as plain text and not executed by the browser.
Conclusion
Plone CMS versions prior to 5.2.4 are vulnerable to a stored Cross-Site Scripting (XSS) attack. It is crucial to upgrade to the latest version or apply appropriate sanitization measures to prevent potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone CMS is an open-source content management system written in Python. It provides a platform for building websites, intranets, and web applications.
A stored XSS vulnerability allows an attacker to inject malicious code into a web application, which is then stored and later executed by other users when they access the affected page.
The consequences of this vulnerability can include session hijacking, defacement of web pages, or theft of sensitive information.
To fix this vulnerability, it is recommended to upgrade to Plone CMS version 5.2.4 or later. Alternatively, you can sanitize user input data before echoing it back to the user.
Yes, if upgrading to the latest version is not immediately feasible, you can sanitize user input data to mitigate the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
