CVE-2021-33507
Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
- Record
CVE-2021-33507- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
- Record
CVE-2021-33507- Updated
- 2026-11-02
EUVDEUVD-2021-0189 No score
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
- Record
EUVD-2021-0189- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-35rg-466w-77h3
Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
- Record
GHSA-35rg-466w-77h3- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
- Record
CVE-2021-33507- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-35rg-466w-77h3
Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
- Record
GHSA-35rg-466w-77h3- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2026-2961
Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
- Record
PYSEC-2026-2961- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVPYSEC-2026-2967
Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
- Record
PYSEC-2026-2967- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVPYSEC-2021-79 No score
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
- Record
PYSEC-2021-79- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
products-cmfcorePyPI |
before 2.5.1 | 2.5.1 |
products-pluggableauthservicePyPI |
before 2.6.2 | 2.6.2 |
plonePyPI |
through 5.2.4 | None known |
products-cmfcorePyPI |
before 2.5.1, plus listed versions 2.1.12.1.22.1.2-beta2.1.32.2.0 Show 37 moreShow less2.2.0-alpha2.2.0-beta2.2.12.2.102.2.112.2.122.2.132.2.22.2.32.2.42.2.52.2.62.2.72.2.82.2.92.3.02.3.0-beta2.3.0-beta22.3.12.4.02.4.0b12.4.0b22.4.0b32.4.0b42.4.0b52.4.0b62.4.0b72.4.0b82.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.82.5.0 |
2.5.1 |
products-pluggableauthservicePyPI |
before 2.6.2, plus listed versions 1.10.01.11.01.11.11.11.21.11.3 Show 41 moreShow less1.5.21.5.2.11.5.31.5.41.5.51.61.6.11.6.21.6.31.6.41.6.51.7.01.7.0b11.7.0b21.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.81.8.01.9.02.02.0b12.0b22.0b32.0b42.0b52.0b62.12.1.12.22.2.12.32.42.52.5.12.6.02.6.1 |
2.6.2 |
plonePyPI |
through 5.2.4, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2 |
None known |
plonePyPI |
before 5.2.5, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a14.1a2 |
5.2.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-33507 is a medium vulnerability (CVSS 6.1) in Plone, published May 21, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in products-cmfcore 2.5.1.
References
plone.org/security/hotfix/20210518/reflected-xss-in-various-spots
openwall.com/lists/oss-security/2021/05/22/1
nvd.nist.gov/vuln/detail/CVE-2021-33507
github.com/advisories/GHSA-35rg-466w-77h3
pypi.org/project/products-cmfcore
Left out here: 189 versions. The JSON record has them.