pluxml 関連製品全体の CVE とセキュリティ脆弱性情報を集約し、CVSS、EPSS、公開日、脆弱性情報データを掲載しています。
一般的な弱点パターンには vendor risk cross-site scripting、パス処理の欠陥, and vendor risk input validation があり、vendor surface production workloads and vendor surface software deployment の利用場面で vendor impact session compromise、ファイル上書き, and vendor impact unexpected behavior などのリスクが生じる可能性があります。
掲載データは公開脆弱性情報とセキュリティ公告に基づき、過去の暴露面と修補優先度の評価に利用できます。
| CVE | 概要 | ソース | CVSS 最大値 | EPSS（%） | 公開 | 更新 |
|---|---|---|---|---|---|---|
| CVE-2025-70129 | If the anti spam-captcha functionality in PluXml versions 5.8.22 and earlier is enabled, a captcha challenge is generated with a format that can be automatically recognized for articles, such that an automated script is able to solve this anti-spam mechanism trivially and publish spam comments. The details of captcha challenge are exposed within document body of articles with comments & anti spam-captcha functionalities enabled, including "capcha-letter", "capcha-word" and "capcha-token" which c | [email protected] | 5.3 | 0.05% | 2026-03-10 | 2026-04-07 |
| CVE-2025-70128 | A Stored Cross-Site Scripting (XSS) vulnerability exists in the PluXml article comments feature for PluXml versions 5.8.22 and earlier. The application fails to properly sanitize or validate user-supplied input in the "link" field of a comment. An attacker can inject arbitrary JavaScript code using a <script> element. The injected payload is stored in the database and subsequently rendered in the Administration panel's "Comments" section when administrators review submitted comments. Importantly | [email protected] | 6.1 | 0.05% | 2026-03-10 | 2026-04-07 |
| CVE-2026-24352 | PluXml CMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This behaviour enables an attacker to fix a session ID for a victim and later hijack the authenticated session. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not test | [email protected] | 4.8 | 0.02% | 2026-02-27 | 2026-05-19 |
| CVE-2026-24351 | PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only versions 5.8.21 and 5.9.0-rc7 were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. | [email protected] | 5.1 | 0.05% | 2026-02-27 | 2026-05-19 |
| CVE-2026-24350 | PluXml CMS is vulnerable to Stored XSS in file uploading functionality. An authenticated attacker can upload an SVG file containing a malicious payload, which will be executed when a victim clicks the link associated with the uploaded image. In version 5.9.0-rc7 clicking the link associated with the uploaded image doesn't execute malicious code but directly accessing the file will still execute the embedded payload. The vendor was notified early about this vulnerability, but didn't respond with | [email protected] | 5.1 | 0.05% | 2026-02-27 | 2026-02-27 |
| CVE-2025-15438 | A vulnerability was determined in PluXml up to 5.8.22. Affected is the function FileCookieJar::__destruct of the file core/admin/medias.php of the component Media Management Module. Executing a manipulation of the argument File can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was informed early about this issue and announced that "[w]e fix this issue in the next version 5.8.23". A patch for it is ready. | [email protected] | 2.0 | 0.05% | 2026-01-02 | 2026-04-29 |
| CVE-2025-67436 | Authenticated Remote Code Execution (RCE) in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme file (e.g., home.php). | [email protected] | 6.5 | 0.15% | 2025-12-22 | 2026-01-02 |
| CVE-2024-22636 | PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field. | [email protected] | 8.8 | 4.77% | 2024-01-25 | 2025-05-30 |
| CVE-2022-25020 | A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post. | [email protected] | 5.4 | 0.99% | 2022-03-01 | 2024-11-21 |
| CVE-2022-25018 | Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages. | [email protected] | 8.8 | 2.69% | 2022-03-01 | 2024-11-21 |
| CVE-2022-24587 | A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML. | [email protected] | 5.4 | 0.19% | 2022-02-15 | 2024-11-21 |
| CVE-2022-24585 | A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter. | [email protected] | 5.4 | 0.19% | 2022-02-15 | 2024-11-21 |
| CVE-2022-24586 | A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail parameters. | [email protected] | 5.4 | 0.19% | 2022-02-15 | 2024-11-21 |
| CVE-2021-38603 | PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field. | [email protected] | 4.8 | 0.65% | 2021-08-12 | 2024-11-21 |
| CVE-2021-38602 | PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content. | [email protected] | 4.8 | 0.52% | 2021-08-12 | 2024-11-21 |
| CVE-2020-18185 | class.plx.admin.php in PluXml 5.7 allows attackers to execute arbitrary PHP code by modify the configuration file in a linux environment. | [email protected] | 9.8 | 0.47% | 2020-10-02 | 2024-11-21 |
| CVE-2017-1001001 | PluXml version 5.6 is vulnerable to stored cross-site scripting vulnerability, within the article creation page, which can result in escalation of privileges. | 46fe6300-5254-4a98-9594-a9567bec8179 | 5.4 | 0.21% | 2017-11-01 | 2026-05-13 |
| CVE-2012-4675 | Cross-site scripting (XSS) vulnerability in PluXml 5.1.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to file update. | [email protected] | 4.3 | 0.33% | 2012-08-26 | 2026-04-29 |
| CVE-2012-4674 | PluXml before 5.1.6 allows remote attackers to obtain the installation path via the PHPSESSID. | [email protected] | 5.0 | 0.30% | 2012-08-26 | 2026-04-29 |
| CVE-2012-2227 | Directory traversal vulnerability in update/index.php in PluXml before 5.1.6 allows remote attackers to include and execute arbitrary local files via a ..%2F (encoded dot dot slash) in the default_lang parameter. | [email protected] | 7.5 | 14.42% | 2012-08-26 | 2026-04-29 |