CVE-2026-16205
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A cross-site scripting vulnerability has been found in Pluck CMS up to version 4.7.21 in the Albums module. The htmlspecialchars_decode function in data/modules/albums/albums.admin.php mishandles the Info argument, allowing remote injection of malicious scripts. The exploit is public, and the project has not responded to the report.
Risk Assessment
An attacker can remotely execute a script in the victim's browser, leading to session theft, redirects to malicious sites, or credential theft. The risk is high due to the availability of a public exploit.
Recommendation
Immediately update Pluck CMS to the latest version or apply a temporary fix such as input validation and sanitization in the Albums module. If no update is available, consider disabling the Albums module.
Other vulnerabilities in Pluck CMS
See all- CVE-2026-70376Critical
Pluck CMS's admin panel relies solely on a Referer-header comparison for CSRF protection, with no per-request anti-CSRF token. This allows attackers to potentially perform unauthorized admin actions if they can bypass the Referer check.
- CVE-2014-8708Critical
Pluck CMS version 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature.
- CVE-2026-54416High
Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php, checked against the last 4-5 characters of the filename.
- CVE-2025-46099High
In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter.
Original NVD description (English source)
A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS