CVE-2026-32095 - Plunk has Stored Cross-Site Scripting (XSS) via SVG File Upload

Back Back to CVE browser

MEDIUM

Plunk has Stored Cross-Site Scripting (XSS) via SVG File Upload

Published Mar 11, 2026

5.4

MEDIUM

CVSS 3.1

EPSS 0.23%

Description

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which browsers treat as active documents capable of executing embedded JavaScript, creating a stored XSS vulnerability. This vulnerability is fixed in 0.7.1.

Affected products

Vendor Useplunk Product Plunk Default
unknown
Affected
- < 0.7.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Useplunk	Plunk	unknown	Affected < 0.7.1

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-11334
Advisory
https://github.com/useplunk/plunk/security/advisories/GHSA-69jg-7493-cx5x
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-11334		Advisory
https://github.com/useplunk/plunk/security/advisories/GHSA-69jg-7493-cx5x		x_refsource_CONFIRMVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitHub_M

Published Mar 11, 2026

Updated Mar 12, 2026

Reserved Mar 10, 2026

Link CVE-2026-32095

CISA Vulnrichment

Updated Mar 12, 2026

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2026-32095

Red Hat

No data

ENISA EUVD

Assigner GitHub_M

Published Mar 11, 2026

Updated Mar 12, 2026

Link EUVD-2026-11334

GitHub

No data