CVE-2021-33507: Plone

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.

Affected products

• Plone Plone: up to and including 4.3.20; from 5.0, up to and including 5.2.4
• Zope Zope: before 2.5.1 (fixed in 2.5.1)

Published 2021-05-21. Last modified 2026-06-17.