CVE-2020-11584: Plesk Onyx

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter.

Affected products

• Plesk Onyx: version 17.8.11 only

Published 2020-08-03. Last modified 2026-06-17.