Log in Start free

Plesk

Products

ProductCVEsExploitedLatest
Plesk2–Dec 3, 2025
Obsidian1–Jul 3, 2025
Plesk Installer1–Nov 27, 2023

Exploited and recent CVEs

  • CVE-2025-66431 High 7.8 WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. The attacker needs "Create and manage site 0.3%
  • CVE-2025-49618 Medium 5.8 In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint. 0.4%
  • CVE-2023-4931 Medium 6.3 Uncontrolled search path element vulnerability in Plesk 0.2%
  • CVE-2023-0829 High 8.8 Cross-Site Scripting (XSS) vulnerability in Plesk 0.7%