EUVD-2026-26959Severity by source
AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the editpage.php and the sanitizePageContent function
AnalysisAI
Stored cross-site scripting in Pluck CMS before v4.7.21dev allows authenticated high-privilege users to inject arbitrary JavaScript via the page editor, escalating privileges through the sanitizePageContent function in editpage.php. The vulnerability requires attacker authentication with administrative role and user interaction (UI:R), limiting spontaneous exploitation but enabling privilege escalation attacks within compromised admin accounts.
Technical ContextAI
The vulnerability exists in the sanitizePageContent function within Pluck CMS's PHP backend (data/inc/functions.all.php, line 207). The editpage.php endpoint processes page content updates but fails to properly sanitize user-supplied input before storage and rendering, allowing malicious JavaScript payloads to persist in the database. When other users or administrators view the affected page, the unescaped script executes in their browser context. This is a classic stored XSS vulnerability in a PHP-based CMS, exploiting insufficient output encoding in the content sanitization layer.
RemediationAI
Upgrade Pluck CMS to version v4.7.21dev or later. The fix addresses the sanitizePageContent function in data/inc/functions.all.php by implementing proper output encoding and input sanitization. Until patching is possible, restrict editpage.php access to trusted administrative users only via firewall rules or web application firewall (WAF) rules, blocking non-whitelisted source IPs; however, this does not eliminate insider threats. Additionally, implement Content Security Policy (CSP) headers with strict-src directives to mitigate XSS payload execution even if injected. Audit existing page content in the database for suspicious JavaScript patterns using grep or database queries targeting script tags in page content fields. References: GitHub repository: https://github.com/pluck-cms/pluck, Issue tracker: https://github.com/pluck-cms/pluck/issues/141.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today