Pluxml vulnerabilities

3 known CVE vulnerabilities in Pluxml, translated and rated.

CVE-2025-15438Medium
A vulnerability was found in PluXml up to 5.8.22 in the FileCookieJar::__destruct function of core/admin/medias.php in the Media Management Module. Manipulating the File argument can lead to deserialization, and the attack can be launched remotely. The exploit has been publicly disclosed and the vendor announced a fix in version 5.8.23.
CVE-2022-25020Medium
A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.
CVE-2022-25018High
Pluxml version 5.8.7 was found to allow attackers to execute arbitrary code by injecting crafted PHP code into static pages.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS