plone has 19 CVEs on record between 2018 and 2026. 3 were published in the last 90 days. The busiest recent month was September 2026 with 3. The median CVSS is 7.5 (high), with 2 rated critical. None have a confirmed exploitation report. Most affected products: plone (16), plone.app.dexterity (1), plone.app.portlets (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.5
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Products
- plone 16
- plone.app.dexterity 1
- plone.app.portlets 1
- plone.app.textfield 1
Worst active — by depth score
CVE-2026-57149Critical· 9.9plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone55CVE-2006-4247Critical· 9.1Plone allows anonymous users to reset any users password through the web via Password Reset Tool50CVE-2020-28736High· 8.8Improper Restriction of XML External Entity Reference in Plone49CVE-2020-28735High· 8.8SSRF attacks via tracebacks in Plone49CVE-2020-28734High· 8.8Improper Restriction of XML External Entity Reference in Plone49
plone vulnerabilities
CVEs affecting plone, newest first. Open any entry for full detail, references, and exploit status.
19 CVEsRSS
CVE-2026-57576Medium· 6.5plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types
plone.app.dexterity is a content-type system for the Plone content management system, and plone.app.contenttypes provides Plone’s Dexterity-based content types. Plone.app.dexterity versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0, …
CVE-2026-57149Critical· 9.9plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone
plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic por…
CVE-2026-54503Medium· 4.3plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type
plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored…
CVE-2024-22889Medium· 5.5PoCPhone information disclosure vulnerability
Phone information disclosure vulnerability
CVE-2024-0669High· 7.1Cross-Frame Scripting vulnerability has been found on Plone CMS
Cross-Frame Scripting vulnerability has been found on Plone CMS
CVE-2011-4030HighPlone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
CVE-2011-1340MediumPlone XSS Vulnerability
Plone XSS Vulnerability
CVE-2008-4571MediumPlone Cross-site Scripting vulnerability in the LiveSearch module
Plone Cross-site Scripting vulnerability in the LiveSearch module
CVE-2006-4249Medium· 5.9Plone allows a user to masquerade as a group
Plone allows a user to masquerade as a group
CVE-2006-4247Critical· 9.1Plone allows anonymous users to reset any users password through the web via Password Reset Tool
Plone allows anonymous users to reset any users password through the web via Password Reset Tool
CVE-2008-0164High· 7.5Plone Cross-site request forgery (CSRF)
Plone Cross-site request forgery (CSRF)
CVE-2008-1394HighPlone CMS Improper Session Management
Plone CMS Improper Session Management
CVE-2006-1711MediumPoCPlone allows remote users to modify arbitrary portraits
Plone allows remote users to modify arbitrary portraits
CVE-2008-1396MediumPlone credentials stored in session cookie
Plone credentials stored in session cookie
CVE-2008-1393HighPlone Improper Session Management
Plone Improper Session Management
CVE-2020-28735High· 8.8SSRF attacks via tracebacks in Plone
SSRF attacks via tracebacks in Plone
CVE-2020-28734High· 8.8Improper Restriction of XML External Entity Reference in Plone
Improper Restriction of XML External Entity Reference in Plone
CVE-2020-28736High· 8.8Improper Restriction of XML External Entity Reference in Plone
Improper Restriction of XML External Entity Reference in Plone
CVE-2011-2528HighHigh severity vulnerability that affects Plone and Zope2
High severity vulnerability that affects Plone and Zope2