EUVD-2026-26959Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the editpage.php and the sanitizePageContent function
AnalysisAI
Stored cross-site scripting in Pluck CMS before v4.7.21dev allows authenticated high-privilege users to inject arbitrary JavaScript via the page editor, escalating privileges through the sanitizePageContent function in editpage.php. The vulnerability requires attacker authentication with administrative role and user interaction (UI:R), limiting spontaneous exploitation but enabling privilege escalation attacks within compromised admin accounts.
Technical ContextAI
The vulnerability exists in the sanitizePageContent function within Pluck CMS's PHP backend (data/inc/functions.all.php, line 207). The editpage.php endpoint processes page content updates but fails to properly sanitize user-supplied input before storage and rendering, allowing malicious JavaScript payloads to persist in the database. When other users or administrators view the affected page, the unescaped script executes in their browser context. This is a classic stored XSS vulnerability in a PHP-based CMS, exploiting insufficient output encoding in the content sanitization layer.
RemediationAI
Upgrade Pluck CMS to version v4.7.21dev or later. The fix addresses the sanitizePageContent function in data/inc/functions.all.php by implementing proper output encoding and input sanitization. Until patching is possible, restrict editpage.php access to trusted administrative users only via firewall rules or web application firewall (WAF) rules, blocking non-whitelisted source IPs; however, this does not eliminate insider threats. Additionally, implement Content Security Policy (CSP) headers with strict-src directives to mitigate XSS payload execution even if injected. Audit existing page content in the database for suspicious JavaScript patterns using grep or database queries targeting script tags in page content fields. References: GitHub repository: https://github.com/pluck-cms/pluck, Issue tracker: https://github.com/pluck-cms/pluck/issues/141.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today