Known Vulnerabilities for products from Plesk
Listed below are 11 of the newest known vulnerabilities associated with the vendor "Plesk".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-56843 json | Not Provided | 2026-07-08 | 2026-07-08 | |
| CVE-2026-48614 json | Not Provided | 2026-07-06 | 2026-07-06 | |
| CVE-2026-44962 json | Not Provided | 2026-05-29 | 2026-05-29 | |
| CVE-2025-65518 json | Not Provided | 2026-01-08 | 2026-07-15 | |
| CVE-2023-43784 json | ** DISPUTED ** Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose compo... | 7.5 - HIGH | 2023-09-22 | 2023-11-07 |
| CVE-2023-24044 json | ** DISPUTED ** A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect... | 6.1 - MEDIUM | 2023-01-22 | 2023-11-07 |
| CVE-2023-4931 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 7.8 - HIGH | 2023-11-27 | 2023-12-01 |
| CVE-2023-0829 json | Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a custome... | 9 - CRITICAL | 2023-09-20 | 2023-09-22 |
| CVE-2022-45130 json | Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian ... | 6.5 - MEDIUM | 2022-11-10 | 2022-11-15 |
| CVE-2021-45008 json | ** DISPUTED ** Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from u... | 8.8 - HIGH | 2022-02-21 | 2023-11-07 |
| CVE-2021-45007 json | ** DISPUTED ** Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to inse... | 6.5 - MEDIUM | 2022-02-20 | 2023-11-07 |
| CVE-2021-35976 json | The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /pl... | 6.1 - MEDIUM | 2021-09-10 | 2021-11-28 |
| CVE-2020-11584 json | A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScr... | 6.1 - MEDIUM | 2020-08-03 | 2023-11-07 |
| CVE-2020-11583 json | A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary Jav... | 6.1 - MEDIUM | 2020-08-03 | 2023-11-07 |
| CVE-2001-1222 json | Plesk Server Administrator (PSA) 1.0 allows remote attackers to obtain PHP source code via an HTTP request containing the tar... | Not Provided | 2002-03-25 | 2025-04-03 |