Kr1S

**Name of the Vulnerable Software and Affected Versions** Pluck CMS versions prior to 4.7.22 **Description** In the Albums Module, the `htmlspecialchars decode()` function within the `data/modules/albums/albums.admin.php` file contains a flaw. A remote attacker can manipulate the `Info` argument to execute cross-site scripting, which occurs when a web application includes untrusted data in a web page without proper validation or encoding, allowing the execution of malicious scripts in the victim's browser. **Recommendations** Update Pluck CMS to version 4.7.22 or later. As a temporary mitigation, restrict access to the `data/modules/albums/albums.admin.php` file or avoid using the `Info` argument within the Albums Module.