CVE-2013-4190: Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py i...

Security readout for executives and security teams

CVE-2013-4190 is a set of cross-site scripting flaws in older Plone releases. An attacker could cause a vulnerable site to serve attacker-controlled script or HTML, potentially affecting users who visit crafted or compromised pages. The bundle names a Plone hotfix but provides no CVSS score or active exploitation evidence. Exposure is most likely on internet-facing or intranet Plone deployments still running the affected legacy versions or missing the 20130618 Plone hotfix. The source bundle’s structured affected-product field is incomplete, but the CVE description clearly names the affected Plone ranges. Medium priority for organizations with legacy Plone. This is not listed in KEV and no active exploitation is cited, but XSS on a public CMS can damage trust, expose user sessions, and support phishing. Patch or retire affected Plone systems during the next security maintenance window, sooner for public sites. Mitigation focus: Inventory Plone sites and identify versions in the affected ranges.; Review the Plone 20130618 advisory and hotfix release notes.; Apply the vendor hotfix or upgrade according to Plone guidance..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.