CVE-2026-32095

Plunk has Stored Cross-Site Scripting (XSS) via SVG File Upload

CVSS 5.4 MEDIUMEPSS 0.1%CWE-79

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.4EPSS 0.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

11 Mar 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which browsers treat as active documents capable of executing embedded JavaScript, creating a stored XSS vulnerability. This vulnerability is fixed in 0.7.1.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

useplunk · plunk

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/useplunk/plunk/security/advisories/GHSA-69jg-7493-cx5x