PT-2026-36805 · Pluck Cms · Pluck Cms

0Xnaka-Hax · Published 2026-05-04 · Updated 2026-05-04 · CVE-2026-31205

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Pluck CMS versions prior to 4.7.21dev

Description A Cross Site Scripting issue allows a remote attacker to escalate privileges. This occurs through the 'editpage.php' endpoint and the sanitizePageContent() function.

Recommendations Update to version 4.7.21dev or later. As a temporary workaround, restrict access to the 'editpage.php' endpoint or the sanitizePageContent() function to minimize the risk of exploitation.

Exploit

Fix

LPE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-31205

Affected Products

Pluck Cms

References · 8

• 🔥 https://medium.com/@nakah_/pluck-cms-stored-xss-in-page-editor-cve-2026-31205-3b0526743e1d?postPublishedType=initial · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-31205 · Security Note
• https://github.com/pluck-cms/pluck/blob/main/data/inc/editpage.php · Note
• https://github.com/pluck-cms/pluck/issues/141 · Note
• https://github.com/pluck-cms/pluck/blob/main/data/inc/functions.all.php#L207 · Note
• https://twitter.com/VulmonFeeds/status/2051324280630100434 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051337787740164604 · Twitter Post
• https://twitter.com/CVEnew/status/2051336129832718435 · Twitter Post