CVE-2011-1948: PYSEC-2026-2966 - Cross-site scripting in Products.CMFPlone and Products.PasswordResetTool

Quick answers

Is CVE-2011-1948 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2011-1948 being exploited in the wild.

How severe is CVE-2011-1948?

Low severity, with a CVSS score of 3.1, published 9 July 2026.

Which products and versions are affected?

plone (PyPI) ECOSYSTEM:introduced=0,fixed=4.1.1; products-cmfplone (PyPI) ECOSYSTEM:introduced=0,fixed=4.0.7, ECOSYSTEM:introduced=0,fixed=4.0.7,introduced=4.1a1,fixed=4.1rc3; products-passwordresettool (PyPI) ECOSYSTEM:introduced=0,fixed=2.0.6.

Is there a fix for CVE-2011-1948?

Yes. plone (PyPI): upgrade to 4.1.1 or later; products-cmfplone (PyPI): upgrade to 4.0.7, 4.1rc3 or later; products-passwordresettool (PyPI): upgrade to 2.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Am I affected by CVE-2011-1948?

Check whether you run plone (PyPI), products-cmfplone (PyPI) or products-passwordresettool (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

• plone (PyPI): upgrade to 4.1.1 or later

  pip install "plone>=4.1.1"

• products-cmfplone (PyPI): upgrade to 4.0.7, 4.1rc3 or later

  pip install "products-cmfplone>=4.1rc3"

• products-passwordresettool (PyPI): upgrade to 2.0.6 or later

  pip install "products-passwordresettool>=2.0.6"

Affected products

• plone (PyPI) ECOSYSTEM:introduced=0,fixed=4.1.1
• products-cmfplone (PyPI) ECOSYSTEM:introduced=0,fixed=4.0.7, ECOSYSTEM:introduced=0,fixed=4.0.7,introduced=4.1a1,fixed=4.1rc3
• products-passwordresettool (PyPI) ECOSYSTEM:introduced=0,fixed=2.0.6

Identifiers

• CVE-2011-1948
• GHSA-p7h9-vf92-5fj5
• PYSEC-2011-14
• PYSEC-2026-2965
• PYSEC-2026-2966