Login Request a demo
PL
Product
PluXml
by Pluxml · last CVE Mar 10, 2026
23
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities23In the news0Timeline
Severity mix
Critical 3High 3Medium 12Low 0
Severity
All severities23Critical3High3Medium12Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add PluXml to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-24352
9.8
0%
Feb 27
Session Fixation in PluXml CMS
Affected: 5.8.21; 5.9.0
CVE-2024-48138
9.8
1%
Oct 29
A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute arbitrary code via…
Affected: before 5.8.16
CVE-2020-18185
9.8
2%
Oct 2
class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment
Affected: 5.7
CVE-2024-22636
8.8
1%
Jan 25
PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature
Affected: 5.8.9
CVE-2022-25018
8.8
3%
Mar 1
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages
Affected: 5.8.7
CVE-2025-15438
7.2
0%
Jan 2
PluXml Media Management medias.php __destruct deserialization
Affected: 5.8.0; 5.8.1; 5.8.2; 5.8.3; 5.8.4; 5.8.5; +17 more
CVE-2025-67436
6.5
1%
Dec 22
Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g.,…
Affected: 5.8.22
CVE-2025-70128
6.1
0%
Mar 10
A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier
Affected: through 5.8.22
CVE-2026-24351
5.4
0%
Feb 27
Stored XSS in PluXml CMS
Affected: 5.8.21; 5.9.0
CVE-2026-24350
5.4
0%
Feb 27
Stored XSS in PluXml CMS
Affected: 5.8.21; 5.9.0
CVE-2022-25020
5.4
1%
Mar 1
A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post
Affected: 5.8.7
CVE-2022-24587
5.4
1%
Feb 15
A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML
Affected: 5.8.7
CVE-2022-24585
5.4
1%
Feb 15
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted…
Affected: 5.8.7
CVE-2022-24586
5.4
1%
Feb 15
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a…
Affected: 5.8.7
CVE-2017-1001001
5.4
1%
Nov 1
PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalation of privileges
Affected: 5.6
CVE-2025-70129
5.3
0%
Mar 10
If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automatically recognized for…
Affected: through 5.8.22
CVE-2021-38603
4.8
1%
Aug 12
PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field
Affected: 5.8.7
CVE-2021-38602
4.8
1%
Aug 12
PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content
Affected: 5.8.7
CVE-2012-4675
–
1%
Aug 26
Cross-site scripting (XSS) vulnerability in PluXml 5.1.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to file update
Affected: through 5.1.5
CVE-2012-4674
–
1%
Aug 26
PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID
Affected: through 5.1.5
CVE-2012-2227
–
10%
Aug 26
Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot…
Affected: through 5.1.5
CVE-2007-3542
–
2%
Jul 3
Cross-site scripting (XSS) vulnerability in admin/auth.php in Pluxml 0.3.1 allows remote attackers to inject arbitrary web script or HTML via the msg parameter
Affected: 0.3.1
CVE-2007-3432
–
8%
Jun 27
Unrestricted file upload vulnerability in admin/images.php in Pluxml 0.3.1 allows remote attackers to upload and execute arbitrary PHP code via a .jpg filename
Affected: 0.3.1
Showing 23