Is there a public PoC exploit available for EUVD-2026-45416?

Yes, a public proof-of-concept exploit is available for EUVD-2026-45416. Prioritise patching immediately. EPSS: 0.2%.

Pluck CMS EUVD-2026-45416

Q: What is the CVSS score of EUVD-2026-45416?

EUVD-2026-45416 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-16205 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-07-19 VulDB

GHSA-9q2q-q44g-f28v

XSS PHP Cms

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.8 MEDIUM

Administrator credentials required to inject payload (PR:H); victim must view the page (UI:R); stored XSS crosses scope to victim browser (S:C); low C/I impact on victim session.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Scope

Lifecycle Timeline

Severity Changed

Jul 19, 2026 - 03:22 NVD

MEDIUM LOW

CVSS changed

Jul 19, 2026 - 03:22 NVD

4.8 (MEDIUM) 1.9 (LOW)

Analysis Generated

Jul 19, 2026 - 02:46 vuln.today

CVE Published

Jul 19, 2026 - 02:00 cve.org

MEDIUM 4.8

DescriptionCVE.org

A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Stored cross-site scripting in Pluck CMS 4.7.21 and earlier allows an authenticated administrator to inject persistent malicious scripts via the Info argument of the Albums module, which subsequently execute in the browsers of users who view the affected content. The flaw originates from misuse of htmlspecialchars_decode in albums.admin.php, which reverses HTML entity encoding on attacker-controlled input rather than sanitizing it, allowing script payloads to survive into rendered HTML. A public proof-of-concept exploit exists on GitHub and no vendor patch has been released; the maintainer has not responded to the disclosure.

Technical ContextAI

Pluck CMS is a lightweight PHP-based content management system. The vulnerability resides in data/modules/albums/albums.admin.php within the Albums module. The core issue is the application of htmlspecialchars_decode to the attacker-supplied Info argument - this PHP function converts HTML entities (e.g., <) back to their raw characters ('<'), which is the inverse of proper output encoding. Applied to user input before storage or rendering, it actively undoes safe encoding and allows raw HTML and script constructs to persist in the CMS data store. CWE-79 (Improper Neutralization of Input During Web Page Generation) identifies the root cause class: input is accepted, entity-decoded rather than entity-encoded, and ultimately rendered as active HTML in victim browsers. The CPE identifier cpe:2.3:a:pluck:cms:*:*:*:*:*:*:*:* covers all Pluck CMS releases up to and including version 4.7.21.

RemediationAI

No vendor-released patch has been identified at time of analysis; the Pluck CMS maintainer has not responded to the coordinated disclosure. Organizations should monitor the upstream GitHub issue at https://github.com/pluck-cms/pluck/issues/145 and VulDB entry https://vuldb.com/vuln/380021 for any forthcoming fix. The most effective immediate compensating control is disabling the Albums module entirely if it is not operationally required, which eliminates the vulnerable code path with no functional side effects for installations not using photo albums. Where the Albums module must remain active, strictly limit administrator account access to the minimum necessary personnel and enforce multi-factor authentication on all admin accounts to reduce the probability of credential compromise. A web application firewall rule blocking common XSS constructs (script tags, javascript: URIs, event handler attributes) in the Albums Info parameter can reduce exploitation probability, but WAF bypass techniques exist and this should not be treated as a complete mitigation. Administrators should also audit existing album entries for previously injected payloads.