CVE-2026-24351

The vulnerability is a stored cross-site scripting (XSS) in PluXml CMS's static pages editing function. An attacker with editing privileges can inject arbitrary HTML and JavaScript code into a static page, which will be rendered and executed when visitors access that page [1].

Exploitation requires an attacker to have an account with at least editing-level permissions. No other authentication bypass is needed. The attacker crafts malicious content in the static page editor, which is then stored and served to all users.

The impact includes theft of session cookies, redirection to malicious sites, defacement, or other actions within the context of the victim's browser. The tested versions are 5.8.21 and 5.9.0-rc7, but other versions may also be affected.

The vendor was notified but did not respond with details or a patch. As of publication, no official fix is available. Users should restrict editing privileges and monitor for updates.