CVE-2020-7937: XSS Vulnerability in Plone
Summary
CVE-2020-7937: An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site. Affects plone versions >= 5.0, < 5.2.2. Fixed in 5.2.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management. Plone versions 5.0 through 5.2.1 are affected by an XSS vulnerability in the title field. This vulnerability allows users with a certain privilege level to insert malicious JavaScript code, which will be executed when other users access the site.
Vulnerability Detail
The XSS vulnerability in Plone arises from insufficient input sanitization in the title field. Attackers with the necessary privilege level can exploit this vulnerability by injecting JavaScript code into the title field. When other users access the site and view the affected content, the injected JavaScript code will be executed in their browsers. This can lead to various malicious activities, such as stealing sensitive information, session hijacking, or performing actions on behalf of the targeted user.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.2.2
This is the first release that contains the fix.
pip install --upgrade "plone==5.2.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the ability for users to add or edit titles that allow HTML content. This can be achieved by modifying the Plone configuration to restrict the allowed HTML tags and attributes in the title field.
Conclusion
The XSS vulnerability in Plone versions 5.0 through 5.2.1 allows privileged users to execute arbitrary JavaScript code in the context of other users' browsers. Upgrading to Plone 5.2.2 or later is the recommended solution to mitigate this vulnerability. If immediate upgrade is not possible, restricting the allowed HTML tags and attributes in the title field can serve as a temporary workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
The vulnerability allows attackers to execute arbitrary JavaScript code in the context of other users' browsers, potentially leading to unauthorized access, data theft, or other malicious activities.
Plone versions 5.0 through 5.2.1 are affected by this XSS vulnerability.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the recommended fixes to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely. Attackers can inject malicious JavaScript code into the title field, which will be executed when other users access the affected content.
No, a CVSS score has not been assigned to this vulnerability at the time of this advisory.
References
Related vulnerabilities
Recent vulnerabilities recorded for plone.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
