pluck-cms vulnerabilities

Products

• pluck 43
• pluckcms 3
• Pluck CMS 2

Latest pluck-cms CVEs

Newest publication first · page 1 of 2

1. CVE-2026-70376 Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE

   Published 2026-08-05

   Critical·CVSS 9.6 EPSS 0.20%

   Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.

2. CVE-2026-54416 Pluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist

   Published 2026-08-05

   High·CVSS 7.2 EPSS 0.50%

   Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked against the last 4-5...

3. CVE-2025-46099 In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in...

   Published 2025-07-23

   High·CVSS 7.2 EPSS 0.56%

   In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter.

4. CVE-2024-9405 An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attacker could extract sensitive information f...

   Published 2024-10-01

   Medium·CVSS 5.3 EPSS 0.46%

   An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attacker could extract sensitive information from the server via the absolute path of a file located in the same directory or...

5. CVE-2024-43042 Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.

   Published 2024-08-16

   Critical·CVSS 9.8 EPSS 0.63%

   Pluck CMS 4.7.18 does not restrict failed login attempts, allowing attackers to execute a brute force attack.

6. CVE-2023-50564 An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.

   Published 2023-12-14

   High·CVSS 8.8 EPSS 29.3%

   An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.

7. CVE-2023-5013 Pluck CMS Installation install.php cross site scripting

   Published 2023-09-16

   Medium·CVSS 5.4 EPSS 0.57%

   A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input <script>alert('xss')</script> leads to...

8. CVE-2023-27082 Cross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4 allows remote attackers to run arbitrary code via upload of crafted html file.

   Published 2023-06-26

   Medium·CVSS 4.8 EPSS 0.59%

   Cross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4 allows remote attackers to run arbitrary code via upload of crafted html file.

9. CVE-2023-27083 An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality.

   Published 2023-06-22

   High·CVSS 7.2 EPSS 1.2%

   An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality.

10. CVE-2020-20919 File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file.

    Published 2023-06-20

    High·CVSS 7.2 EPSS 1.3%

    File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file.

11. CVE-2020-20918 An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden parameter to admin.php when editing a page.

    Published 2023-06-20

    High·CVSS 7.2 EPSS 1.1%

    An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden parameter to admin.php when editing a page.

12. CVE-2020-20718 File Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute arbitrary code via a crafted image file to the the save_file() parameter.

    Published 2023-06-20

    Critical·CVSS 9.8 EPSS 1.3%

    File Upload vulnerability in PluckCMS v.4.7.10 dev versions allows a remote attacker to execute arbitrary code via a crafted image file to the the save_file() parameter.

13. CVE-2020-20969 File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_restoreitem.php file.

    Published 2023-06-20

    High·CVSS 7.2 EPSS 6.2%

    File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_restoreitem.php file.

14. CVE-2023-25828 Authenticate Remote Code Execution in Pluck CMS

    Published 2023-03-27

    High·CVSS 7.2 EPSS 1.6%

    Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to create collections of images that can be inserted into web pages across the site. Albums allow the upload of various filetypes, which undergo a no...

15. CVE-2022-26589 A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages.

    Published 2022-04-12

    Medium·CVSS 6.5 EPSS 0.48%

    A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to delete arbitrary pages.

16. CVE-2022-27432 A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to account takeover.

    Published 2022-03-29

    High·CVSS 8.8 EPSS 0.58%

    A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to account takeover.

17. CVE-2022-26965 In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.

    Published 2022-03-18

    High·CVSS 7.2 EPSS 36.3%

    In Pluck 4.7.16, an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.

18. CVE-2021-27984 In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files.

    Published 2021-12-10

    High·CVSS 8.1 EPSS 2.6%

    In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files.

19. CVE-2021-31747 Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could lead to man-in-the-middle attacks.

    Published 2021-12-10

    Medium·CVSS 4.8 EPSS 0.35%

    Missing SSL Certificate Validation issue exists in Pluck 4.7.15 in update_applet.php, which could lead to man-in-the-middle attacks.

20. CVE-2021-31746 Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal and potentially arbitrary code execution.

    Published 2021-12-10

    Critical·CVSS 9.8 EPSS 2.5%

    Zip Slip vulnerability in Pluck-CMS Pluck 4.7.15 allows an attacker to upload specially crafted zip files, resulting in directory traversal and potentially arbitrary code execution.

21. CVE-2021-31745 Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not invalidate prior sessions after a passwo...

    Published 2021-12-10

    High·CVSS 7.5 EPSS 1.2%

    Session Fixation vulnerability in login.php in Pluck-CMS Pluck 4.7.15 allows an attacker to sustain unauthorized access to the platform. Because Pluck does not invalidate prior sessions after a password change, access can be sustained even after an administrator performs regular...

22. CVE-2020-20951 In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files.

    Published 2021-05-18

    Critical·CVSS 9.8 EPSS 4.0%

    In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files.

23. CVE-2020-24740 An issue was discovered in Pluck 4.7.10-dev2. There is a CSRF vulnerability that can editpage via a /admin.php?action=editpage

    Published 2021-05-18

    Medium·CVSS 4.3 EPSS 0.40%

    An issue was discovered in Pluck 4.7.10-dev2. There is a CSRF vulnerability that can editpage via a /admin.php?action=editpage

24. CVE-2020-18198 Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.php?action=images."

    Published 2021-05-17

    High·CVSS 8.8 EPSS 0.93%

    Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete specific images via the component " /admin.php?action=images."

25. CVE-2020-18195 Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /admin.php?action=page."

    Published 2021-05-17

    High·CVSS 8.8 EPSS 0.93%

    Cross Site Request Forgery (CSRF) in Pluck CMS v4.7.9 allows remote attackers to execute arbitrary code and delete a specific article via the component " /admin.php?action=page."

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.