# CVE-2021-33507: PYSEC-2026-2967 - Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone

Source: https://junglewise.ai/threats/cve-2021-33507-plone-reflected-cross-site-scripting-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2021-33507 · Severity: low · CVSS 3.1 · Published 2026-07-09

Plone is an open-source content management system used to publish and manage web content. A reflected cross-site scripting (XSS) vulnerability in multiple Plone components allows attackers to inject malicious scripts that execute in users' browsers when they visit a crafted link, potentially stealing session cookies, redirecting users to phishing sites, or defacing page content.

Technologies: [Plone](https://junglewise.ai/threats/technologies/plone), [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone), [products-pluggableauthservice (PyPI)](https://junglewise.ai/threats/technologies/products-pluggableauthservice). Vendors: [Plone](https://junglewise.ai/threats/vendors/plone), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2021-33507 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-33507 being exploited in the wild.

**How severe is CVE-2021-33507?** Low severity, with a CVSS score of 3.1, published 9 July 2026.

**Which products and versions are affected?** Plone through 5.2.4; plone (PyPI) ECOSYSTEM:introduced=0,fixed=5.2.5; products-cmfcore (PyPI) ECOSYSTEM:introduced=0,fixed=2.5.1; products-pluggableauthservice (PyPI) ECOSYSTEM:introduced=0,fixed=2.6.2.

**Is there a fix for CVE-2021-33507?** Yes. plone (PyPI): upgrade to 5.2.5 or later; products-cmfcore (PyPI): upgrade to 2.5.1 or later; products-pluggableauthservice (PyPI): upgrade to 2.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-33507 attacked?** It is attacked over the network.

**Am I affected by CVE-2021-33507?** Check whether you run Plone, plone (PyPI), products-cmfcore (PyPI) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- plone (PyPI): upgrade to 5.2.5 or later

  ```sh
  pip install "plone>=5.2.5"
  ```

- products-cmfcore (PyPI): upgrade to 2.5.1 or later

  ```sh
  pip install "products-cmfcore>=2.5.1"
  ```

- products-pluggableauthservice (PyPI): upgrade to 2.6.2 or later

  ```sh
  pip install "products-pluggableauthservice>=2.6.2"
  ```


## Technical details

This reflected XSS vulnerability exists in Zope's Products.CMFCore (before 2.5.1) and Products.PluggableAuthService (before 2.6.2) components, which are core parts of the Plone CMS. The vulnerability arises from improper input validation and output encoding in multiple locations within the application. An attacker can craft a malicious URL containing unescaped script payloads and distribute it to users; when a victim visits the link, the script executes in their browser within the context of the vulnerable application. No authentication is required and the attack requires only user interaction (clicking a link). Patches have been released for both affected libraries (CMFCore 2.5.1+ and PluggableAuthService 2.6.2+).

## Affected products

- Zope Products.CMFCore before 2.5.1
- Zope Products.PluggableAuthService before 2.6.2
- Plone Plone through 5.2.4

## Identifiers

- CVE-2021-33507
- GHSA-35rg-466w-77h3
- PYSEC-2021-79
- PYSEC-2026-2961
- PYSEC-2026-2967

## Timeline

- 2021-05-21: disclosed: Published to NVD
- 2021-06-18: advisory: Published to GitHub Advisory Database as GHSA-35rg-466w-77h3
- 2021-05-18: patched: Security hotfix released by Plone project

## Related threats

- [PYSEC-2026-2889 - Plone Privilege Escallation](https://junglewise.ai/threats/cve-2020-7938-plone-privilege-escallation)
- [PYSEC-2026-2964 - Plone unauthorized member addition vulnerability](https://junglewise.ai/threats/cve-2015-7315-plone-unauthorized-member-addition-vulnerability)
- [PYSEC-2026-2962 - Products.CMFPlone XSS in profile home_page property](https://junglewise.ai/threats/cve-2017-1000482-products-cmfplone-xss-in-profile-home-page-property)
- [PYSEC-2026-2963 - Products.CMFPlone Open Redirect Vulnerability](https://junglewise.ai/threats/cve-2017-1000481-products-cmfplone-open-redirect-vulnerability)
- [PYSEC-2026-2888 - Plone and plone.app.users allow remote authenticated users to modify the properties of arbitrary accounts](https://junglewise.ai/threats/cve-2011-1950-plone-privilege-escalation-in-account-property-modification)