A stored cross‑site scripting flaw exists in the editpage.php module of Pluck CMS versions prior to 4.7.21dev. The flaw resides in the sanitizePageContent function, which fails to neutralize injected script content. An attacker who can inject malicious payloads into page content can execute arbitrary JavaScript in the context of the CMS, allowing unauthorized control and privilege escalation.

All installations of Pluck CMS older than version 4.7.21dev are affected. No official vendor/product list is available, but the vulnerability exists in the editpage.php page and the sanitizePageContent function across those releases.

The CVSS score is 5.7, indicating moderate risk. EPSS data is unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit this flaw remotely by posting malicious content through the web interface; no special credentials are required beyond access to the page editor. Exploitation would result in privileged code execution within the CMS.