# plone (PyPI) vulnerabilities

Source: https://junglewise.ai/threats/technologies/pypi-plone  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/pypi-plone.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 101 vulnerabilities in plone (PyPI): 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2020-7938, was published on 9 July 2026.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 0
- All time: 101 (1 critical, 0 exploited in the wild)

## About plone (PyPI)

Open-source content management system and framework for building web applications.

## Latest plone (PyPI) vulnerabilities

- [CVE-2020-7938: PYSEC-2026-2889 - Plone Privilege Escallation](https://junglewise.ai/threats/cve-2020-7938-plone-privilege-escallation) (low, CVSS 3.1, published 9 Jul 2026)
- [CVE-2015-7315: PYSEC-2026-2964 - Plone unauthorized member addition vulnerability](https://junglewise.ai/threats/cve-2015-7315-plone-unauthorized-member-addition-vulnerability) (low, CVSS 3.1, published 9 Jul 2026)
- [CVE-2017-1000482: PYSEC-2026-2962 - Products.CMFPlone XSS in profile home_page property](https://junglewise.ai/threats/cve-2017-1000482-products-cmfplone-xss-in-profile-home-page-property) (low, CVSS 3, published 9 Jul 2026)
- [CVE-2017-1000481: PYSEC-2026-2963 - Products.CMFPlone Open Redirect Vulnerability](https://junglewise.ai/threats/cve-2017-1000481-products-cmfplone-open-redirect-vulnerability) (low, CVSS 3, published 9 Jul 2026)
- [CVE-2021-33507: PYSEC-2026-2967 - Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone](https://junglewise.ai/threats/cve-2021-33507-plone-reflected-cross-site-scripting-vulnerability) (low, CVSS 3.1, published 9 Jul 2026)
- [CVE-2011-1950: PYSEC-2026-2888 - Plone and plone.app.users allow remote authenticated users to modify the properties of arbitrary accounts](https://junglewise.ai/threats/cve-2011-1950-plone-privilege-escalation-in-account-property-modification) (low, CVSS 3.1, published 9 Jul 2026)
- [CVE-2011-1948: PYSEC-2026-2966 - Cross-site scripting in Products.CMFPlone and Products.PasswordResetTool](https://junglewise.ai/threats/cve-2011-1948-cross-site-scripting-in-products-cmfplone-and-products) (low, CVSS 3.1, published 9 Jul 2026)
- [CVE-2024-22889: PYSEC-2026-1798 - Phone information disclosure vulnerability](https://junglewise.ai/threats/cve-2024-22889-phone-information-disclosure-vulnerability) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2024-0669: PYSEC-2026-1797 - Cross-Frame Scripting vulnerability has been found on Plone CMS](https://junglewise.ai/threats/cve-2024-0669-cross-frame-scripting-vulnerability-has-been-found-on-plone-cms) (low, CVSS 3.1, published 7 Jul 2026)
- [CVE-2011-1340: PYSEC-2026-896 - Plone XSS Vulnerability](https://junglewise.ai/threats/cve-2011-1340-plone-xss-vulnerability) (info, published 6 Jul 2026)
- [CVE-2011-4030: PYSEC-2026-897 - Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable](https://junglewise.ai/threats/cve-2011-4030-plone-anonymous-access-to-sub-objects-in-cmfeditions-where) (info, published 6 Jul 2026)
- [CVE-2008-4571: PYSEC-2026-730 - Plone Cross-site Scripting vulnerability in the LiveSearch module](https://junglewise.ai/threats/cve-2008-4571-plone-cross-site-scripting-vulnerability-in-the-livesearch-module) (info, published 2 Jul 2026)
- [CVE-2008-1396: PYSEC-2026-732 - Plone credentials stored in session cookie](https://junglewise.ai/threats/cve-2008-1396-plone-credentials-stored-in-session-cookie) (info, published 2 Jul 2026)
- [CVE-2008-1393: PYSEC-2026-731 - Plone Improper Session Management](https://junglewise.ai/threats/cve-2008-1393-plone-improper-session-management) (info, published 2 Jul 2026)
- [CVE-2008-1394: PYSEC-2026-734 - Plone CMS Improper Session Management](https://junglewise.ai/threats/cve-2008-1394-plone-cms-improper-session-management) (info, published 2 Jul 2026)
- [CVE-2006-1711: PYSEC-2026-733 - Plone allows remote users to modify arbitrary portraits](https://junglewise.ai/threats/cve-2006-1711-plone-allows-remote-users-to-modify-arbitrary-portraits) (info, published 2 Jul 2026)
- [CVE-2020-28736: PYSEC-2026-735 - Improper Restriction of XML External Entity Reference in Plone](https://junglewise.ai/threats/cve-2020-28736-plone-xml-external-entity-injection-in-schema-editor) (low, CVSS 3.1, published 2 Jul 2026)
- [CVE-2020-28735: PYSEC-2026-737 - SSRF attacks via tracebacks in Plone](https://junglewise.ai/threats/cve-2020-28735-ssrf-attacks-via-tracebacks-in-plone) (low, CVSS 3.1, published 2 Jul 2026)
- [CVE-2020-28734: PYSEC-2026-736 - Improper Restriction of XML External Entity Reference in Plone](https://junglewise.ai/threats/cve-2020-28734-improper-restriction-of-xml-external-entity-reference-in-plone) (low, CVSS 3.1, published 2 Jul 2026)
- [CVE-2020-7941: PYSEC-2026-459 - Plone Unauthenticated Write Vulnerability](https://junglewise.ai/threats/cve-2020-7941-plone-unauthenticated-write-vulnerability) (low, CVSS 3.1, published 29 Jun 2026)
- [CVE-2021-33926: Server-Side Request Forgery in Plone CMS](https://junglewise.ai/threats/cve-2021-33926-server-side-request-forgery-in-plone-cms) (low, CVSS 3.1, published 17 Feb 2023)
- [CVE-2008-0164: Plone CMS CSRF in join_form and prefs_groups_overview](https://junglewise.ai/threats/cve-2008-0164-plone-cms-csrf-in-join-form-and-prefs-groups-overview) (high, CVSS 7.5, published 1 May 2022)
- [CVE-2006-4249: Plone PlonePAS group masquerading via anonymous registration](https://junglewise.ai/threats/cve-2006-4249-plone-plonepas-group-masquerading-via-anonymous-registration) (medium, CVSS 5.9, published 1 May 2022)
- [CVE-2006-4247: Plone Password Reset Tool unauthorized password reset](https://junglewise.ai/threats/cve-2006-4247-plone-password-reset-tool-unauthorized-password-reset) (critical, CVSS 9.1, published 1 May 2022)
- [CVE-2021-35959: Plone has stored XSS in folder contents](https://junglewise.ai/threats/cve-2021-35959-plone-has-stored-xss-in-folder-contents) (low, CVSS 3.1, published 30 Jun 2021)

## Most severe plone (PyPI) vulnerabilities

- [CVE-2006-4247: Plone Password Reset Tool unauthorized password reset](https://junglewise.ai/threats/cve-2006-4247-plone-password-reset-tool-unauthorized-password-reset) (critical, CVSS 9.1, published 1 May 2022)
- [CVE-2011-2528: Plone and Zope2 privilege escalation via incorrect security fix](https://junglewise.ai/threats/cve-2011-2528-plone-and-zope2-privilege-escalation-via-incorrect-security-fix) (high, CVSS 7.5, published 23 Jul 2018)
- [CVE-2008-0164: Plone CMS CSRF in join_form and prefs_groups_overview](https://junglewise.ai/threats/cve-2008-0164-plone-cms-csrf-in-join-form-and-prefs-groups-overview) (high, CVSS 7.5, published 1 May 2022)
- [CVE-2009-0662: Plone Products.PlonePAS improper authentication in login form](https://junglewise.ai/threats/cve-2009-0662-plone-products-plonepas-improper-authentication-in-login-form) (medium, CVSS 6, published 23 Jul 2018)
- [CVE-2006-4249: Plone PlonePAS group masquerading via anonymous registration](https://junglewise.ai/threats/cve-2006-4249-plone-plonepas-group-masquerading-via-anonymous-registration) (medium, CVSS 5.9, published 1 May 2022)
- [CVE-2011-4462: Plone Denial of Service vulnerability](https://junglewise.ai/threats/cve-2011-4462-plone-denial-of-service-vulnerability) (low, CVSS 3.1, published 30 Dec 2011)
- [CVE-2011-0720: Plone Privilege Escalation Vulnerability](https://junglewise.ai/threats/cve-2011-0720-plone-privilege-escalation-vulnerability) (low, CVSS 3.1, published 3 Feb 2011)
- [CVE-2012-5498: Plone denial of service via Caching Bypass](https://junglewise.ai/threats/cve-2012-5498-plone-denial-of-service-via-caching-bypass) (low, CVSS 3.1, published 30 Sep 2014)
- [CVE-2012-5488: Plone Code Injection vulnerability](https://junglewise.ai/threats/cve-2012-5488-plone-code-injection-vulnerability) (low, CVSS 3.1, published 30 Sep 2014)
- [CVE-2012-5486: HTTP header injection in Plone and Zope2](https://junglewise.ai/threats/cve-2012-5486-http-header-injection-in-plone-and-zope2) (low, CVSS 3.1, published 30 Sep 2014)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 0 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other PyPI technologies

- [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities
- [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities
- [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities
- [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities
- [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities
- [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities
- [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities
- [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities
- [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities
- [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities
- [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities
- [exiv2 (PyPI)](https://junglewise.ai/threats/technologies/exiv2): 85 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "plone (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/pypi-plone, 13 November 2026.