VulertSecurity VulertSecurity

Vulnerability Database · PyPI · plone · Version

plone 6.0.0a1

6.0.0a1 is affected by 30 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 6.2.2.

Critical 1 High 4 Medium 18 Low 0 Unrated 7

All plone versions & vulnerabilities → Search the database for this package →
Released 16 Oct 2021 Licence GPL-2.0 Also known from other sources 5 Newer releases 207 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

plone 6.0.0a1 vulnerabilities

30 vulnerabilities cover plone 6.0.0a1. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2020-7941: Plone Unauthenticated Write Vulnerability 9.8 critical No fix published 24 May 2022
CVE-2020-7939: Plone SQL Injection Vulnerability 8.8 high No fix published 24 May 2022
CVE-2021-33511: Server-Side Request Forgery in Plone 7.5 high No fix published 15 Jun 2021
CVE-2024-0669: Plone CMS Cross-Frame Scripting Vulnerability 7.1 high 6.0.7 07 Jul 2026
Cross-Frame Scripting Vulnerability in Plone CMS 7.1 high 6.0.7 18 Jan 2024
CVE-2021-35959: Stored XSS in Plone folder contents 6.1 medium No fix published 24 May 2022
CVE-2016-7137: Plone Open Redirect Vulnerability 6.1 medium No fix published 14 May 2022
CVE-2016-7136: Plone XSS 6.1 medium No fix published 14 May 2022
CVE-2016-7138: Plone XSS 6.1 medium No fix published 14 May 2022
CVE-2024-22889: Plone Phone Information Disclosure Vulnerability 5.5 medium No fix published 07 Jul 2026
CVE-2024-22889: Phone information disclosure vulnerability in Plone 5.5 medium No fix published 06 Mar 2024
Plone cross site scripting (XSS) 5.4 medium No fix published 24 May 2022
CVE-2020-7937: XSS Vulnerability in Plone 5.4 medium No fix published 24 May 2022
CVE-2021-33508: Cross-site scripting in Plone 5.4 medium No fix published 08 Jun 2021
CVE-2021-33512: Cross-site scripting in Plone 5.4 medium No fix published 08 Jun 2021
CVE-2021-33513: Cross-site scripting in Plone 5.4 medium No fix published 08 Jun 2021
CVE-2021-29002: Plone CMS 5.2.3 Stored XSS Vulnerability in Site Control Panel 5.4 medium No fix published 24 Mar 2021
CVE-2013-4189: Plone Privilege Escalation 4.9 medium No fix published 17 May 2022
CVE-2016-4043: Chameleon in Plone allows Authentication Bypass 4.9 medium No fix published 17 May 2022
CVE-2013-4198: Plone - Authenticated Users Able to Alter Password Despite Policy Definition 4.3 medium No fix published 17 May 2022
CVE-2021-33510: Server-Side Request Forgery in Plone 4.3 medium No fix published 15 Jun 2021
CVE-2008-1396: Plone CMS 3.1.x Authentication Cookie Vulnerability N/A unrated No fix published 02 Jul 2026
CVE-2006-1711: Plone Remote Portrait Modification Vulnerability N/A unrated 2.0.6 02 Jul 2026
CVE-2021-29002: Plone XSS Vulnerability N/A medium No fix published 24 May 2022
CVE-2008-1396: Plone credentials stored in session cookie N/A medium No fix published 01 May 2022
CVE-2011-2528: Plone Package Privilege Escalation Vulnerability N/A unrated No fix published 19 Jul 2011
CVE-2009-0662: Plone Package Vulnerability Allows Identity Acquisition of Arbitrary Users N/A unrated No fix published 23 Apr 2009
CVE-2008-0164: Plone CMS Cross-Site Request Forgery Vulnerabilities N/A unrated No fix published 20 Mar 2008
CVE-2006-4249: Plone Package Vulnerability Allows Group Masquerading N/A unrated No fix published 07 Dec 2006
CVE-2006-4247: Plone Password Reset Tool Vulnerability Allows Unauthorized Password Resets N/A unrated No fix published 29 Sep 2006

Looking for another version, or everything Vulert holds for plone?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About plone 6.0.0a1

Is plone 6.0.0a1 vulnerable?

Yes. 30 vulnerabilities in the Vulert database cover plone 6.0.0a1: 1 critical, 4 high, 18 medium and 0 low, plus 7 not yet rated. The upgrade Vulert recommends is 6.2.2, and each entry above names the fixed version to move to.

Which version of plone should I use instead of 6.0.0a1?

6.2.2 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 6.0.0a1 the latest release of plone?

No. 6.0.0a1 was published 16 Oct 2021, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor plone for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the plone version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.