Plesk’s APS Application Catalog search functionality is vulnerable to XPath injection. User‑supplied input is inserted directly into an XPath query without proper sanitization, allowing an attacker to inject arbitrary XPath expressions. This flaw leads to execution of arbitrary operating system commands with the privileges of the process hosting Plesk, resulting in local privilege escalation for authenticated users with low privileges.

The vulnerability affects all installations of WebPros Plesk that provide the APS Application Catalog search feature. No specific version details are supplied, so any on‑premises or hosted Plesk environment is potentially impacted unless a patch has already been applied.

The CVSS score of 10 indicates that this flaw is maximum severity. The EPSS score is not available, and the vulnerability is not yet listed in CISA KEV, but the lack of an exploit probability rating does not diminish the inherent risk. Based on the description, the likely attack vector is an authenticated low‑privileged user who can access the search functionality; such a user can exploit the injection to execute arbitrary OS commands, achieving full control of the server.