CVE-2021-33513: XSS vulnerability in Plone
Summary
CVE-2021-33513: Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool. Affects plone versions < 5.2.5. Fixed in 5.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications. Plone is widely used due to its security features and extensibility. However, it is susceptible to a cross-site scripting (XSS) vulnerability through the inline_diff methods in Products.CMFDiffTool.
Vulnerability Detail
The XSS vulnerability in Plone allows an attacker to inject malicious scripts into web pages viewed by users. This can lead to various security risks, including session hijacking, data theft, and defacement of the affected website. The vulnerability arises from inadequate input sanitization in the inline_diff methods of Products.CMFDiffTool.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.5
This is the first release that contains the fix.
pip install --upgrade "plone==5.2.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the inline_diff functionality in Products.CMFDiffTool. This can be achieved by modifying the Plone configuration to remove or comment out the relevant lines of code that enable inline_diff.
Conclusion
The XSS vulnerability in Plone through version 5.2.4 poses a significant security risk to websites and web applications built on this platform. It is crucial to upgrade to Plone version 5.2.5 or later to address this vulnerability. If immediate upgrading is not possible, disabling the inline_diff functionality can serve as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. These scripts can be used to steal sensitive information, manipulate web content, or perform unauthorized actions on behalf of the user.
The XSS vulnerability in Plone allows attackers to execute arbitrary scripts in the context of a user's browser. This can lead to various security risks, such as session hijacking, data theft, and unauthorized actions performed on behalf of the user.
Yes, the XSS vulnerability has been fixed in Plone version 5.2.5. It is recommended to upgrade to this version or later to mitigate the risk of exploitation.
Yes, a temporary workaround is to disable the inline_diff functionality in Products.CMFDiffTool. This can be achieved by modifying the Plone configuration to remove or comment out the relevant lines of code that enable inline_diff.
You can find more information about this vulnerability in the official Plone security advisory PYSEC-2021-85. The advisory provides detailed information about the vulnerability, its impact, and the recommended steps for mitigation.
References
Related vulnerabilities
Recent vulnerabilities recorded for plone.
