Back
CVE-2026-16205
Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting
Medium4.8EPSS 0.35%
- Published
- Updated
- Reserved
- Assigned by
- VulDB
Description
A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulDBCNA (assigner) | 4.0 | Medium4.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P |
| VulDBCNA (assigner) | 3.1 | Low2.4 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R |
| VulDBCNA (assigner) | 3.0 | Low2.4 | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R |
| VulDBCNA (assigner) | 2.0 | Low3.3 | AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR |
| NVDNVD · Deferred | 4.0 | Low1.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.35% · top 71% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.
Weakness
Affected products
- affected 4.7.0
- affected 4.7.1
- affected 4.7.2
- affected 4.7.3
- affected 4.7.4
- affected 4.7.5
- affected 4.7.6
- affected 4.7.7
- affected 4.7.8
- affected 4.7.9
- affected 4.7.10
- affected 4.7.11
- affected 4.7.12
- affected 4.7.13
- affected 4.7.14
- affected 4.7.15
- affected 4.7.16
- affected 4.7.17
- affected 4.7.18
- affected 4.7.19
- affected 4.7.20
- affected 4.7.21
References (5)
- VDB-380021 | Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting (opens in a new tab)vdb-entrytechnical-description
- VDB-380021 | CTI Indicators (IOB, IOC, TTP, IOA) (opens in a new tab)signaturepermissions-required
- CVE-2026-16205 | CVE Analysis and Report (opens in a new tab)third-party-advisory
- Submit #857798 | pluck pluck-cms <= 4.7.21 dev Improper Neutralization of Alternate XSS Syntax (opens in a new tab)third-party-advisory
- https://github.com/pluck-cms/pluck/issues/145 (opens in a new tab)exploitissue-tracking
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-16205)Record last updated .