CVE-2021-33512: Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.

Security readout for executives and security teams

Plone sites through version 5.2.4 could let a Contributor store harmful script content by uploading SVG or HTML files. The risk is user-impacting because the script may run later when someone views the uploaded content. The sources do not provide a CVSS score or evidence of active exploitation. Exposure is most likely on Plone deployments at or below 5.2.4 where Contributor users can upload SVG or HTML files. Public, multi-author, partner, or customer-accessible content portals deserve closer review than tightly controlled single-admin sites. Treat this as a moderate-priority patch and permission-review item. Escalate for public or multi-author Plone portals, especially where Contributor accounts are broadly issued or privileged users regularly review uploaded content. Mitigation focus: Apply the Plone 20210518 security hotfix where applicable.; Check current Plone vendor guidance for fixed upgrade paths.; Restrict SVG and HTML uploads to trusted users only..

Prepared

Jun 3, 2026, 02:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.