PT-2026-39195 · Plunk · Plunk

Bigbluewhale111 · Published 2026-05-08 · Updated 2026-05-09 · CVE-2026-42192

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plunk versions prior to 0.9.0

Description A stored cross-site scripting (XSS) issue exists in the campaign management feature. Authenticated project members can embed malicious scripts in a campaign's email body, which are stored and subsequently rendered in the admin dashboard using React's dangerouslySetInnerHTML without HTML sanitization. This allows a lower-privileged member to execute scripts in the context of an admin or other member viewing the campaign, potentially leading to session hijacking or unauthorized actions.

Recommendations Update to version 0.9.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-42192

Affected Products

Plunk

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-42192 · Security Note
• https://github.com/useplunk/plunk/releases/tag/v0.9.0 · Note
• https://github.com/useplunk/plunk/security/advisories/GHSA-mjqc-qrv3-24hq · Note
• https://twitter.com/CVEnew/status/2053131441350074499 · Twitter Post