CVE-2026-16205

Name of the Vulnerable Software and Affected Versions Pluck CMS versions prior to 4.7.22

Description In the Albums Module, the htmlspecialchars decode() function within the data/modules/albums/albums.admin.php file contains a flaw. A remote attacker can manipulate the Info argument to execute cross-site scripting, which occurs when a web application includes untrusted data in a web page without proper validation or encoding, allowing the execution of malicious scripts in the victim's browser.

Recommendations Update Pluck CMS to version 4.7.22 or later. As a temporary mitigation, restrict access to the data/modules/albums/albums.admin.php file or avoid using the Info argument within the Albums Module.