Cross-Site Scripting Vulnerability in Plone RichText Field Type
CVE-2026-54503
4.3MEDIUM
What is CVE-2026-54503?
The plone.app.textfield component prior to versions 2.0.2, 3.0.2, and 4.0.1 is vulnerable to cross-site scripting (XSS) due to the RichTextValue.output method returning unsanitized RichText values, especially when the mimeType matches the outputMimeType. This flaw can allow malicious users to insert JavaScript into the RichText field, leading to execution in a viewer's browser when the malicious content is rendered. The issue has been addressed in the aforementioned versions, enhancing the security of RichText outputs.
Affected Version(s)
plone.app.textfield < 2.0.2 < 2.0.2
plone.app.textfield >= 3.0.0, < 3.0.2 < 3.0.0, 3.0.2
plone.app.textfield >= 4.0.0, < 4.0.1 < 4.0.0, 4.0.1