CVE-2016-7140: Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6...

Security readout for executives and security teams

This issue lets an attacker inject script or HTML into the Zope Management Interface used by affected Plone CMS versions. Business impact depends on who can reach that interface and whether privileged users can be targeted. The source bundle does not provide CVSS, CWE, or confirmed active exploitation evidence. Exposure is most likely where affected Plone administrative or ZMI functionality is reachable by untrusted users, internet users, or lower-privileged authenticated users. Public-facing Plone sites should be checked first, especially older 3.x, 4.x, and early 5.x deployments. Prioritize if the organization still runs affected Plone versions or exposes administrative interfaces. This is not marked as actively exploited in the supplied evidence, but public disclosure and admin-interface XSS make remediation important for legacy Plone systems. Mitigation focus: Inventory Plone CMS versions and flag affected 3.3.x, 4.x, and 5.x deployments.; Apply the Plone 20160830 hotfix where vendor guidance says it applies.; Upgrade affected Plone deployments to a vendor-supported fixed release where feasible..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.