CVE-2026-10850 — Plane 1.3.1 - Stored XSS in intake issue description_html
Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the API v1 intake endpo…
Published: 2026-06-17 · CVSS: 6.9 · CVSS 4.0
Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the description_html field when creating an intake work item through the API v1 intake endpoint.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7