CVE-2026-16205
Received Received - Intake

Cross-Site Scripting in Pluck CMS

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: VulDB

Description
A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-19
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-16205
EUVD
EUVD-2026-45416

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pluck_cms pluck to 4.7.21 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in Pluck CMS versions up to 4.7.21. It affects the albums module where an authenticated administrator can inject malicious JavaScript into an image description field. The input is improperly decoded before rendering, allowing script execution when the page is viewed by others.

Detection Guidance

Check Pluck CMS versions up to 4.7.21 for the albums module. Look for unencoded JavaScript in image descriptions stored in the database. Inspect frontend album pages for unexpected script execution.

Impact Analysis

An attacker could steal session cookies or perform actions on behalf of users visiting the affected album page. This could lead to unauthorized access to user accounts or sensitive data if the victim has elevated privileges.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. It may result in non-compliance if exploited.

Mitigation Strategies

Remove htmlspecialchars_decode() from untrusted frontend output paths in the albums module. Apply proper context-appropriate output encoding for user-controlled input. Upgrade to a patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16205. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart