pluck cms vulnerabilities

Latest pluck cms CVEs

Newest publication first

1. CVE-2026-16205 Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting

   Published 2026-07-19

   Medium·CVSS 4.8 EPSS 0.35%

   A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scriptin...

2. CVE-2023-5013 Pluck CMS Installation install.php cross site scripting

   Published 2023-09-16

   Medium·CVSS 5.4 EPSS 0.57%

   A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic. This vulnerability affects unknown code of the file install.php of the component Installation Handler. The manipulation of the argument contents with the input <script>alert('xss')</script> leads to...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.