plone
Security Risk Profile
19
/100
lowSecurity Risk Score
Comprehensive risk assessment based on 144 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from April 11, 2006 to present
144
Total CVEs
51
Critical+High
0
Exploited
10
Unpatched
Threat Assessment
Avg CVSS
5.9
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
10
Critical/High
Risk Level
19/100
low
Severity Distribution
Critical
14High
37Medium
72Low
19Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
5Age Distribution
Common Weaknesses (CWE)
1
XSS
33
2
Infoleak
11
3
Input Validation
6
4
Code Injection
5
5
SSRF
4
Most Affected Products
1. Plone plone3893
2. Zope Zope183
3. pip/Plone117
4. pip/plone79
5. Plone Volto Node.js41
Recent Vulnerabilities
See more →CVE-2026-28413
CVSS 6.1EPSS 0%medium
Products.isurlinportal: Possible open redirect when using more than 2 forward slashes
3/2/2026
https://seclists.org/oss-sec/2025/q3/142
unknown
CVE-2025-58047: DoS in Volto (Plone CMS)
8/28/2025🔧 No Patch
CVE-2024-22889
CVSS 7.5high
3/5/2024🔧 No Patch
CVE-2024-23756
CVSS 7.5EPSS 0%high
2/8/2024🔧 No Patch
CVE-2024-23054
CVSS 9.8EPSS 0%critical
2/5/2024🔧 No Patch
CVE-2024-23055
CVSS 6.1EPSS 0%medium
1/25/2024🔧 No Patch
CVE-2024-0669
CVSS 7.1EPSS 0%high
Cross-Frame Scripting (XFS) on Plone CMS
1/18/2024
https://seclists.org/oss-sec/2023/q3/208
unknown
Plone security advisory 2023/09/21
9/22/2023🔧 No Patch
CVE-2023-42457
CVSS 7.5high
plone.rest vulnerable to Denial of Service when ++api++ is used many times
9/21/2023
CVE-2023-41048
CVSS 5.4medium
plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images
9/21/2023
Monitor plone in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.