{"action":"Upgrade plone to 5.2.5 or later.","affected":[{"fixed":"5.2.5","introduced":"5.0"}],"component":"plone","cve_ids":["CVE-2021-35959"],"ecosystem":"PyPI","epss":0.00541,"exploited":false,"fixed_versions":["5.2.5"],"ghsa_id":"GHSA-qfhw-fv3g-v836","id":"tcs_01M5KGB2ZWJG0CCE0Q8B2R42FM","modified_at":"2026-06-10T17:02:30.932679876Z","published_at":"2021-06-30T01:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-110","https://plone.org/security/hotfix/20210518/stored-xss-in-folder-contents","http://www.openwall.com/lists/oss-security/2021/06/30/2","https://github.com/advisories/GHSA-qfhw-fv3g-v836"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-110","url":"https://osv.dev/vulnerability/PYSEC-2021-110"}],"summary":"In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field."}