CVE-2022-25020
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk64th percentile - higher than 64% of all known CVEs
Summary
A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.
Risk Assessment
The risk includes session hijacking, redirection to malicious sites, or theft of sensitive data, potentially compromising system confidentiality and integrity.
Recommendation
Immediately update Pluxml to the latest version and implement input validation for thumbnail paths.
Other vulnerabilities in Pluxml
See all- CVE-2025-15438Medium
A vulnerability was found in PluXml up to 5.8.22 in the FileCookieJar::__destruct function of core/admin/medias.php in the Media Management Module. Manipulating the File argument can lead to deserialization, and the attack can be launched remotely. The exploit has been publicly disclosed and the vendor announced a fix in version 5.8.23.
- CVE-2022-25018High
Pluxml version 5.8.7 was found to allow attackers to execute arbitrary code by injecting crafted PHP code into static pages.
Original NVD description (English source)
A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS