CVE-2026-10850

Plane 1.3.1 - Stored XSS in intake issue description_html PUBLISHED

Description (CNA)

Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the API v1 intake endpoint.

Affected (CNA)

Vendor / product	Versions
Plane / Plane	affected 1.3.1

CWE

CWE-79

References

https://fluidattacks.com/es/advisories/earth
https://github.com/makeplane/plane

ADP enrichment

CISA-ADP

No English description supplied.

https://fluidattacks.com/es/advisories/earth