CVE-2026-16205
Full vulnerability record from the local CVENow database.
Description
A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Severity
LOW
CVSS score
1.9
(v4.0)
Vulnerability status
Deferred
Source identifier
Published
2026-07-19 03:16:42.250000
Last modified
2026-10-24 20:10:00.137000
View original CVE JSON
{
"id": "CVE-2026-16205",
"sourceIdentifier": "[email protected]",
"published": "2026-07-19T03:16:42.250",
"lastModified": "2026-10-24T20:10:00.137",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
},
{
"lang": "es",
"value": "Una debilidad ha sido identificada en Pluck CMS hasta la versión 4.7.21. Esta vulnerabilidad afecta la función htmlspecialchars_decode del archivo data/modules/albums/albums.admin.php del componente Módulo de Álbumes. La ejecución de una manipulación del argumento Info puede llevar a cross-site scripting. Es posible lanzar el ataque de forma remota. El exploit ha sido puesto a disposición del público y podría ser utilizado para ataques. El proyecto fue informado del problema tempranamente a través de un informe de incidencias, pero aún no ha respondido."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Pluck",
"product": "CMS",
"cpes": [
"cpe:2.3:a:pluck:cms:*:*:*:*:*:*:*:*"
],
"modules": [
"Albums Module"
],
"versions": [
{
"version": "4.7.0",
"status": "affected"
},
{
"version": "4.7.1",
"status": "affected"
},
{
"version": "4.7.2",
"status": "affected"
},
{
"version": "4.7.3",
"status": "affected"
},
{
"version": "4.7.4",
"status": "affected"
},
{
"version": "4.7.5",
"status": "affected"
},
{
"version": "4.7.6",
"status": "affected"
},
{
"version": "4.7.7",
"status": "affected"
},
{
"version": "4.7.8",
"status": "affected"
},
{
"version": "4.7.9",
"status": "affected"
},
{
"version": "4.7.10",
"status": "affected"
},
{
"version": "4.7.11",
"status": "affected"
},
{
"version": "4.7.12",
"status": "affected"
},
{
"version": "4.7.13",
"status": "affected"
},
{
"version": "4.7.14",
"status": "affected"
},
{
"version": "4.7.15",
"status": "affected"
},
{
"version": "4.7.16",
"status": "affected"
},
{
"version": "4.7.17",
"status": "affected"
},
{
"version": "4.7.18",
"status": "affected"
},
{
"version": "4.7.19",
"status": "affected"
},
{
"version": "4.7.20",
"status": "affected"
},
{
"version": "4.7.21",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 1.9,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "HIGH",
"userInteraction": "PASSIVE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "PROOF_OF_CONCEPT",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N",
"baseScore": 2.4,
"baseSeverity": "LOW",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 0.9,
"impactScore": 1.4
}
],
"cvssMetricV2": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "2.0",
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N",
"baseScore": 3.3,
"accessVector": "NETWORK",
"accessComplexity": "LOW",
"authentication": "MULTIPLE",
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"availabilityImpact": "NONE"
},
"baseSeverity": "LOW",
"exploitabilityScore": 6.4,
"impactScore": 2.9,
"acInsufInfo": false,
"obtainAllPrivilege": false,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-20T17:11:51.727073Z",
"id": "CVE-2026-16205",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-79"
},
{
"lang": "en",
"value": "CWE-94"
}
]
}
],
"references": [
{
"url": "https://github.com/pluck-cms/pluck/issues/145",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/cve/CVE-2026-16205",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/submit/857798",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/380021",
"source": "[email protected]"
},
{
"url": "https://vuldb.com/vuln/380021/cti",
"source": "[email protected]"
}
]
}