Plenti is a narrowly scoped vendor centered on a single product platform, with a durable signal characterized by application-layer injection and code-generation vulnerabilities spanning output encoding, code injection, path traversal, and OS command injection. These weakness classes reflect common risks in templating and dynamic code execution patterns; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Plenti over time
Signals from CVEs in this vendor scope (3 CVEs).
3 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-49380HIGH Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write vulnerabil | Oct 25, 2024 | 7.5 | 33 | NO | YES |
CVE-2025-26260HIGH Plenti <= 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the | Mar 12, 2025 | 8.8 | 23 | NO | NO |
CVE-2024-49381HIGH Plenti, a static site generator, has an arbitrary file deletion vulnerability in versions prior to 0.7.2. The `/postLocal` endpoint is vulnerable to an arbitrary file write deletio | Oct 25, 2024 | 7.5 | 22 | NO | NO |
Signals from CVEs in this vendor scope (3 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Plenti.
Media articles that mention a CVE ID that affects a product developed by Plenti — matched by CVE ID, not by vendor name.