PT-2026-61039 · Pluck Cms · Pluck Cms

Kr1S · CVE-2026-16205 · Published 2026-07-19 · Updated 2026-07-19

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:N/AC:L/Au:M/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pluck CMS versions prior to 4.7.22

Description In the Albums Module, the htmlspecialchars decode() function within the data/modules/albums/albums.admin.php file contains a flaw. A remote attacker can manipulate the Info argument to execute cross-site scripting, which occurs when a web application includes untrusted data in a web page without proper validation or encoding, allowing the execution of malicious scripts in the victim's browser.

Recommendations Update Pluck CMS to version 4.7.22 or later. As a temporary mitigation, restrict access to the data/modules/albums/albums.admin.php file or avoid using the Info argument within the Albums Module.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-16205

Affected Products

Pluck Cms

References · 7

• 🔥 https://github.com/pluck-cms/pluck/issues/145 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-16205 · Security Note
• https://twitter.com/VulmonFeeds/status/2078687096089309356 · Twitter Post
• https://vuldb.com/vuln/380021 · Note
• https://vuldb.com/cve/CVE-2026-16205 · Note
• https://vuldb.com/submit/857798 · Note
• https://vuldb.com/vuln/380021/cti · Note