Plesk is a web hosting control panel and server management platform deployed across hosting providers and resellers, presenting a concentrated but prominent attack surface centered on a single product line. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity, and recur through application-layer weakness classes including cross-site scripting, cross-site request forgery, improper access control, and permission-handling flaws that are characteristic of feature-rich administrative interfaces. Defenders should prioritize patches for this vendor given its role in hosting infrastructure and the severity tendency of its disclosures; live exploitation and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Plesk over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-66430CRITICAL Plesk 18.0 has Incorrect Access Control. | Dec 12, 2025 | 9.1 | 32 | NO | NO |
CVE-2021-45008HIGH Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that this is only a site-s | Feb 21, 2022 | 8.8 | 29 | NO | NO |
CVE-2025-66431HIGH WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. The attacker needs "Cr | Dec 3, 2025 | 7.8 | 25 | NO | NO |
CVE-2023-0829CRITICAL Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can fully compromise the serv | Sep 20, 2023 | 9.0 | 25 | NO | NO |
CVE-2023-24044MEDIUM A Host Header Injection issue on the Login page of Plesk Obsidian through 18.0.49 allows attackers to redirect users to malicious websites via a Host request header. NOTE: the vend | Jan 22, 2023 | 6.1 | 23 | NO | NO |
CVE-2023-4931HIGH Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folde | Nov 27, 2023 | 7.8 | 22 | NO | NO |
CVE-2023-43784HIGH Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOTE: the vendor's position is that there is no security threat. | Sep 22, 2023 | 7.5 | 22 | NO | NO |
CVE-2022-45130MEDIUM Plesk Obsidian allows a CSRF attack, e.g., via the /api/v2/cli/commands REST API to change an Admin password. NOTE: Obsidian is a specific version of the Plesk product: version num | Nov 10, 2022 | 6.5 | 22 | NO | NO |
CVE-2020-11584MEDIUM A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript, HTML, or CSS via a GET parameter. | Aug 3, 2020 | 6.1 | 22 | NO | NO |
CVE-2021-35976MEDIUM The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH, aka PFSI-62467. The attacker co | Sep 10, 2021 | 6.1 | 21 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Plesk.
Media articles that mention a CVE ID that affects a product developed by Plesk — matched by CVE ID, not by vendor name.