Executive brief
Pluck CMS, a lightweight content management system, contains a security vulnerability in its Albums Module. An attacker with administrative privileges can inject malicious scripts into album information fields, which could then execute in the browser of other users. This could lead to unauthorized actions being performed in the context of the victim's session.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Pluck CMS versions up to 4.7.21 within the Albums Module. The issue is located in the 'htmlspecialchars_decode' function call within 'data/modules/albums/albums.admin.php'. An attacker with high privileges (administrator) can manipulate the 'Info' argument to inject arbitrary web scripts. The vulnerability is triggered when the injected content is rendered for a user. While a public exploit exists, the attack requires high privileges and user interaction, resulting in a low CVSS score. No official patch has been released by the vendor at the time of reporting.
Affected products
- Pluck CMS up to 4.7.21
Timeline
- 2026-07-18: disclosed: Issue reported to vendor via GitHub issue 145
- 2026-07-19: advisory: CVE published by VulDB/NVD