Pluck CMS vulnerabilities
5 known CVE vulnerabilities in Pluck CMS, translated and rated.
- CVE-2026-70376Critical
Pluck CMS's admin panel relies solely on a Referer-header comparison for CSRF protection, with no per-request anti-CSRF token. This allows attackers to potentially perform unauthorized admin actions if they can bypass the Referer check.
- CVE-2014-8708Critical
Pluck CMS version 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature.
- CVE-2026-54416High
Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php, checked against the last 4-5 characters of the filename.
- CVE-2026-16205Low
A cross-site scripting vulnerability has been found in Pluck CMS up to version 4.7.21 in the Albums module. The htmlspecialchars_decode function in data/modules/albums/albums.admin.php mishandles the Info argument, allowing remote injection of malicious scripts. The exploit is public, and the project has not responded to the report.
- CVE-2025-46099High
In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter.