CVE-2026-42192: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in useplunk plunk
Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cross-site scripting (XSS) vulnerability exists in the campaign management feature, where the email body content created by authenticated project members is stored and later rendered in the admin dashboard using React's dangerouslySetInnerHTML without any HTML sanitization. This allows a lower-privileged member to embed malicious scripts in a campaign's email body that execute in the context of any admin or other member who views the campaign, potentially enabling session hijacking or unauthorized actions on their behalf. This issue has been patched in version 0.9.0.
AI Analysis
Technical Summary
The vulnerability CVE-2026-42192 in useplunk plunk is a stored cross-site scripting (CWE-79) flaw affecting versions before 0.9.0. It arises because the email body content in campaigns is rendered using React's dangerouslySetInnerHTML without sanitization, allowing malicious script injection by authenticated but lower-privileged users. These scripts execute in the context of any admin or member who views the campaign, potentially enabling session hijacking or unauthorized actions. The issue is fixed in version 0.9.0. The product is a cloud service built on AWS SES, and the vendor manages patching server-side.
Potential Impact
Exploitation of this vulnerability allows an authenticated lower-privileged user to inject malicious scripts into campaign email bodies, which execute when viewed by admins or other members. This can lead to session hijacking or unauthorized actions performed on behalf of the victim user. There is no indication of impact on availability. The CVSS score of 5.4 reflects a medium severity impact on confidentiality and integrity.
Mitigation Recommendations
A patch addressing this vulnerability is available in useplunk plunk version 0.9.0. Since the product is a cloud-hosted service, the vendor manages remediation and patch deployment server-side. Users should ensure they are using version 0.9.0 or later to mitigate this issue. Check the vendor advisory for confirmation of patch deployment status. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-42192: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in useplunk plunk
Description
Plunk is an open-source email platform built on top of AWS SES. Prior to version 0.9.0, a stored cross-site scripting (XSS) vulnerability exists in the campaign management feature, where the email body content created by authenticated project members is stored and later rendered in the admin dashboard using React's dangerouslySetInnerHTML without any HTML sanitization. This allows a lower-privileged member to embed malicious scripts in a campaign's email body that execute in the context of any admin or other member who views the campaign, potentially enabling session hijacking or unauthorized actions on their behalf. This issue has been patched in version 0.9.0.
CVSS v3.1
Score 5.4medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-42192 in useplunk plunk is a stored cross-site scripting (CWE-79) flaw affecting versions before 0.9.0. It arises because the email body content in campaigns is rendered using React's dangerouslySetInnerHTML without sanitization, allowing malicious script injection by authenticated but lower-privileged users. These scripts execute in the context of any admin or member who views the campaign, potentially enabling session hijacking or unauthorized actions. The issue is fixed in version 0.9.0. The product is a cloud service built on AWS SES, and the vendor manages patching server-side.
Potential Impact
Exploitation of this vulnerability allows an authenticated lower-privileged user to inject malicious scripts into campaign email bodies, which execute when viewed by admins or other members. This can lead to session hijacking or unauthorized actions performed on behalf of the victim user. There is no indication of impact on availability. The CVSS score of 5.4 reflects a medium severity impact on confidentiality and integrity.
Mitigation Recommendations
A patch addressing this vulnerability is available in useplunk plunk version 0.9.0. Since the product is a cloud-hosted service, the vendor manages remediation and patch deployment server-side. Users should ensure they are using version 0.9.0 or later to mitigate this issue. Check the vendor advisory for confirmation of patch deployment status. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-25T01:53:21.583Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 69fe575bcbff5d86102f610e
Added to database: 05/08/2026, 21:36:27 UTC
Last enriched: 05/16/2026, 10:16:48 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 88
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.