PatchTheCVECVE-2021-3313: Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname prope
CVE-2021-3313 is a medium-severity flaw (CVSS 5.4) affecting plone. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.4 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 1.0% (top 38%) |
| CISA exploited list | No |
| Weakness | CWE-79 |
| Published | 2021-05-20 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-3313?
plone: upgrade to 5.2.4. Exact commands for each OS are on this page.
Is CVE-2021-3313 being exploited?
CVE-2021-3313 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-3313 affect?
CVE-2021-3313 affects plone. Severity is medium (CVSS 5.4). Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data
How urgent is CVE-2021-3313?
Priority 39/100. Public exploit reference
Related CVEs
- CVE-2024-23756 HIGH 7.5 DOWNGRADE The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unaut
- CVE-2024-22889 HIGH 7.5 DOWNGRADE Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted o
- CVE-2024-0669 MEDIUM 6.3 UPGRADE A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5
- CVE-2022-23599 MEDIUM 4.3 UPGRADE Products.ATContentTypes are the core content types for Plone 2.1 - 4.3
- CVE-2021-33926 HIGH 8.8 DOWNGRADE An issue in Plone CMS v