Skip to content
OpenAdvisories

Vendor

useplunk

5 known vulnerabilities.

Products

plunk 5
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-42192

    Plunk: Stored XSS in campaign view

    Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cross-site scripting (XSS) vulnerability exists in the campaign management feature, where the email body content created by authenticated project members is store…

    useplunk plunk
  • Medium 5.4
    CVE-2026-32095

    Plunk has Stored Cross-Site Scripting (XSS) via SVG File Upload

    Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which browsers treat as active documents capable of executing embedded JavaScript, creating a stored XSS vulnerability. This vuln…

    useplunk plunk