EUVD-2026-45416
GHSA-9q2q-q44g-f28v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Administrator credentials required to inject payload (PR:H); victim must view the page (UI:R); stored XSS crosses scope to victim browser (S:C); low C/I impact on victim session.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Stored cross-site scripting in Pluck CMS 4.7.21 and earlier allows an authenticated administrator to inject persistent malicious scripts via the Info argument of the Albums module, which subsequently execute in the browsers of users who view the affected content. The flaw originates from misuse of htmlspecialchars_decode in albums.admin.php, which reverses HTML entity encoding on attacker-controlled input rather than sanitizing it, allowing script payloads to survive into rendered HTML. A public proof-of-concept exploit exists on GitHub and no vendor patch has been released; the maintainer has not responded to the disclosure.
Technical ContextAI
Pluck CMS is a lightweight PHP-based content management system. The vulnerability resides in data/modules/albums/albums.admin.php within the Albums module. The core issue is the application of htmlspecialchars_decode to the attacker-supplied Info argument - this PHP function converts HTML entities (e.g., <) back to their raw characters ('<'), which is the inverse of proper output encoding. Applied to user input before storage or rendering, it actively undoes safe encoding and allows raw HTML and script constructs to persist in the CMS data store. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause class: input is accepted, entity-decoded rather than entity-encoded, and ultimately rendered as active HTML in victim browsers. The CPE identifier cpe:2.3:a:pluck:cms:*:*:*:*:*:*:*:* covers all Pluck CMS releases up to and including version 4.7.21.
RemediationAI
No vendor-released patch has been identified at time of analysis; the Pluck CMS maintainer has not responded to the coordinated disclosure. Organizations should monitor the upstream GitHub issue at https://github.com/pluck-cms/pluck/issues/145 and VulDB entry https://vuldb.com/vuln/380021 for any forthcoming fix. The most effective immediate compensating control is disabling the Albums module entirely if it is not operationally required, which eliminates the vulnerable code path with no functional side effects for installations not using photo albums. Where the Albums module must remain active, strictly limit administrator account access to the minimum necessary personnel and enforce multi-factor authentication on all admin accounts to reduce the probability of credential compromise. A web application firewall rule blocking common XSS constructs (script tags, javascript: URIs, event handler attributes) in the Albums Info parameter can reduce exploitation probability, but WAF bypass techniques exist and this should not be treated as a complete mitigation. Administrators should also audit existing album entries for previously injected payloads.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today