CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-21616: Plane has a Cross-site scripting (XSS) via SVG image upload
5.4
CVSS
Description
Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions prior to 0.23. The vulnerability allows authenticated users to upload SVG files containing malicious JavaScript code as profile images, which gets executed in victims' browsers when viewing the profile image.
Classification
CVE ID: CVE-2025-21616
CVSS Base Severity: MEDIUM
CVSS Base Score: 5.4
Affected Products
Vendor: makeplane
Product: plane
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.04% (probability of being exploited)
EPSS Percentile: 11.48% (scored less or equal to compared to others)
EPSS Date: 2025-02-04 (when was this score calculated)