CVE-2016-7136: Cross-Site Scripting (XSS) in Plone CMS
Summary
CVE-2016-7136: z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted GET request. Affects plone across 2 version ranges.
>= 4.2, < 4.3.12
>= 5.0, < 5.0.7
Fixed in 4.3.12 or 5.0.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone CMS is an open-source content management system written in Python. It provides a robust and flexible platform for building websites, intranets, and web applications. The z3c.form library is used in Plone CMS to handle form generation and validation. This vulnerability affects Plone CMS versions 5.x through 5.0.6 and 4.x through 4.3.11.
Vulnerability Detail
The vulnerability identified as CVE-2016-7136 allows remote attackers to conduct cross-site scripting (XSS) attacks by exploiting a flaw in the z3c.form library. An attacker can exploit this vulnerability by sending a crafted GET request to the affected Plone CMS instance. Successful exploitation of this vulnerability can lead to unauthorized access, data theft, or the execution of malicious code in the context of the victim's browser.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2, < 4.3.124.3.12pip install --upgrade "plone==4.3.12" -
>= 5.0, < 5.0.75.0.7pip install --upgrade "plone==5.0.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, a temporary workaround can be implemented by applying input validation and output encoding to mitigate the risk of XSS attacks. Developers should carefully review and sanitize user input before displaying it on web pages. Additionally, output encoding should be applied to ensure that any user-supplied data is properly escaped to prevent it from being interpreted as HTML or JavaScript code.
Conclusion
The CVE-2016-7136 vulnerability in Plone CMS exposes websites to cross-site scripting attacks. It is crucial to upgrade to the latest patched version of Plone CMS or apply the recommended workarounds to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Successful exploitation of this vulnerability can allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities.
No, only Plone CMS versions 5.x through 5.0.6 and 4.x through 4.3.11 are affected. It is recommended to upgrade to the latest patched version to mitigate this vulnerability.
There is no known evidence of active exploits targeting this vulnerability at the time of this report. However, it is crucial to apply the necessary patches or upgrades to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely by sending a crafted GET request to the affected Plone CMS instance.
Yes, you can use Vulert's playground at Vulert Scanner to check if your Plone CMS instance is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
