- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 10 · 1 high, 7 medium
- Weekly downloads
- 22.2K
- Dependents
- 183
- Registry
- PyPI
Advisories 10
- CVE-2026-75526Medium 4.4
django CMS: Stored XSS in edit-mode plugin exception rendering
Affected: from 5.0.8, fixed in 5.0.9.
- CVE-2026-63003Medium 6.5
django CMS: Broken access control in page Duplicate allows reading the content of any page (cross-site / restriction bypass)
Affected: fixed in 5.0.9.
- CVE-2026-61663Medium 4.3
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
Affected: fixed in 5.0.9.
- CVE-2026-54622Medium 6.5
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
Affected: fixed in 5.0.8.
- CVE-2026-54624Medium 6.5
django CMS: Structure endpoint bypasses page-view permission
Affected: fixed in 5.0.8.
- CVE-2026-54623High 7.1
django CMS: Plugin move endpoint allows cyclic reparenting (DoS)
Affected: fixed in 5.0.8.
- CVE-2026-54625Medium 4.8
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
Affected: fixed in 5.0.8.
- CVE-2024-11319Medium 4.8
Stored XSS in Open Source Project "django-cms"
Affected: from 3.11.7, fixed in 3.11.9; from 4.1.2, fixed in 4.1.4.
- CVE-2021-44649Unrated
Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a…
Affected: from 3.7.0, fixed in 3.7.4; from 3.6.0, fixed in 3.6.1; from 3.5.0, fixed in 3.5.4; from 3.4.0, fixed in 3.4.7; from 3.4.0, fixed in 3.4.7; from 3.5.0, fixed in 3.5.4; from 3.6.0, fixed in 3.6.1; from 3.7.0, fixed in 3.7.4.
- CVE-2015-5081Unrated
Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate…
Affected: fixed in 3.0.14; from 3.1, fixed in 3.1.1; fixed in 3.0.14; from 3.1.0b1, fixed in 3.1.1.