Plesk vulnerabilities
We track 4 vulnerabilities in Plesk products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on December 3, 2025.
Latest Plesk vulnerabilities
- 7.8 High severity
Plesk: UNIX Symbolic Link (Symlink) Following
WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. The attacker needs "Create and manage sites" with "Domains management" and "Subdomains management."
- 7.8 High severity
Plesk Installer: Uncontrolled Search Path Element
Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hijacking in edputil.dll,
- 7.5 High severity
Onyx: Exposure of Resource to Wrong Sphere
Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component. NOTE: the vendor's position is that there is no security threat.
- 9.0 Critical severity
Plesk: Improper Neutralization of Input During Web Page Generation
Plesk 17.0 through 18.0.31 version, is vulnerable to a Cross-Site Scripting. A malicious subscription owner (either a customer or an additional user), can fully compromise the server if an administrator visits a certain page in Plesk related to the malicious s