PluXml CMS allows a user’s session identifier to be set before authentication, and that identifier remains unchanged after login. This flaw, a classic session‑fixation weakness (CWE-384), lets an attacker predefine a session ID, then later hijack the victim’s authenticated session and immediately gain access to the application with the victim’s privileges.

Versions 5.8.21 and 5.8.9:rc7 of PluXml CMS have been confirmed vulnerable; other releases have not been tested but may also be affected. All sites running these or later unpatched instances are at risk.

The CVSS score of 4.8 signals medium severity, and the EPSS of less than 1 percent indicates a low probability of widespread exploitation, though targeted attacks remain feasible. The vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is inferred from the description: an attacker can set a session ID via cookie or URL parameter before a user logs in; if the CMS does not regenerate the ID thereafter, the attacker’s session remains valid and can be used to hijack the account.