CVE-2026-16205 - Vulnerability Details

- Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting

Description

A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Published: 2026-07-19

Score: 4.8 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A weakness exists in the Albums module of Pluck CMS where the function htmlspecialchars_decode can be exploited through a manipulated Info argument. This flaw allows an attacker to inject arbitrary scripts into the output that is rendered in the admin interface, leading to cross‑site scripting in the admin area.

Affected Systems

Pluck CMS installations up to and including version 4.7.21 that include the Albums module are vulnerable. The flaw is present in the core code of the module and no patch is currently available for these versions.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity, and the EPSS score is under 1 %, suggesting low to very low exploitation likelihood at present. The vulnerability is not listed in the CISA KEV catalog, but exploit code is publicly available. The attack vector is remote, as an unauthenticated user can send a crafted request to the album admin endpoint to trigger the flaw.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Pluck

CMS

affected

Version	Status	Constraints
`4.7.0`	affected	—
`4.7.1`	affected	—
`4.7.2`	affected	—
`4.7.3`	affected	—
`4.7.4`	affected	—
`4.7.5`	affected	—
`4.7.6`	affected	—
`4.7.7`	affected	—
`4.7.8`	affected	—
`4.7.9`	affected	—
`4.7.10`	affected	—
`4.7.11`	affected	—
`4.7.12`	affected	—
`4.7.13`	affected	—
`4.7.14`	affected	—
`4.7.15`	affected	—
`4.7.16`	affected	—
`4.7.17`	affected	—
`4.7.18`	affected	—
`4.7.19`	affected	—
`4.7.20`	affected	—
`4.7.21`	affected	—

No data.

Vendor Product Confidence Versions

Pluck

Cms

100%

Version	Status	Scheme	Platform
`4.7.0`	affected	semver	—
`4.7.1`	affected	semver	—
`4.7.2`	affected	semver	—
`4.7.3`	affected	semver	—
`4.7.4`	affected	semver	—
`4.7.5`	affected	semver	—
`4.7.6`	affected	semver	—
`4.7.7`	affected	semver	—
`4.7.8`	affected	semver	—
`4.7.9`	affected	semver	—
`4.7.10`	affected	semver	—
`4.7.11`	affected	semver	—
`4.7.12`	affected	semver	—
`4.7.13`	affected	semver	—
`4.7.14`	affected	semver	—
`4.7.15`	affected	semver	—
`4.7.16`	affected	semver	—
`4.7.17`	affected	semver	—
`4.7.18`	affected	semver	—
`4.7.19`	affected	semver	—
`4.7.20`	affected	semver	—
`4.7.21`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Install the latest Pluck CMS release once a patch for the Albums module is issued, ensuring the insecure use of htmlspecialchars_decode has been removed.
Until a patch is available, modify the albums.admin.php file to encode any data derived from the Info parameter before rendering it in a browser, or eliminate the call to htmlspecialchars_decode entirely.
Apply strict input validation on the Info parameter, allowing only safe characters or a predefined whitelist, and reject requests containing suspicious script tags or encoded payloads.

Generated by OpenCVE AI on July 30, 2026 at 22:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Multiple

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00202.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/pluck-cms/pluck/issues/145
https://vuldb.com/cve/CVE-2026-16205
https://vuldb.com/submit/857798
https://vuldb.com/vuln/380021
https://vuldb.com/vuln/380021/cti

History

Mon, 20 Jul 2026 19:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sun, 19 Jul 2026 02:30:00 +0000

Type	Values Removed	Values Added
Description		A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Title		Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting
First Time appeared		Pluck Pluck cms
Weaknesses		CWE-79 CWE-94
CPEs		cpe:2.3:a:pluck:cms::::::::
Vendors & Products		Pluck Pluck cms
References		https://github.com/pluck-cms/pluck/issues/145 https://vuldb.com/cve/CVE-2026-16205 https://vuldb.com/submit/857798 https://vuldb.com/vuln/380021 https://vuldb.com/vuln/380021/cti
Metrics		cvssV2_0 `{'score': 3.3, 'vector': 'AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}` cvssV3_0 `{'score': 2.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}` cvssV3_1 `{'score': 2.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}` cvssV4_0 `{'score': 4.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Pluck Cms

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-07-19T02:00:09.299Z

Updated: 2026-07-20T19:10:11.563Z

Reserved: 2026-07-18T07:37:53.771Z

Link: CVE-2026-16205

Vulnrichment

Updated: 2026-07-20T17:11:55.814Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-30T23:00:22Z

Weaknesses

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-94
Improper Control of Generation of Code ('Code Injection')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication Multiple

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object