CVE-2026-16205 Overview
CVE-2026-16205 is a cross-site scripting (XSS) vulnerability in Pluck CMS versions up to 4.7.21. The flaw resides in the htmlspecialchars_decode function within data/modules/albums/albums.admin.php, part of the Albums Module. Attackers can manipulate the Info argument to inject arbitrary script content that executes in the browser of an authenticated administrator. The issue is classified under [CWE-79] (Improper Neutralization of Input During Web Page Generation). The exploit has been disclosed publicly, and the project maintainers have not yet responded to the issue report.
Critical Impact
Authenticated attackers can inject persistent JavaScript into Pluck CMS admin pages, enabling session theft, account takeover, and unauthorized administrative actions.
Affected Products
- Pluck CMS versions up to and including 4.7.21
- data/modules/albums/albums.admin.php (Albums Module component)
- Deployments exposing the Pluck CMS administrative interface to the network
Discovery Timeline
- 2026-07-19 - CVE-2026-16205 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-16205
Vulnerability Analysis
The vulnerability affects the Albums Module of Pluck CMS. When an administrator submits album metadata, the Info argument is processed through htmlspecialchars_decode in data/modules/albums/albums.admin.php. This function reverses HTML entity encoding, which reintroduces raw markup into content that is later rendered in the browser. Because the decoded output reaches the DOM without subsequent sanitization, an attacker with authenticated access can persist HTML and JavaScript payloads inside album Info fields. The stored payload executes when any user views the affected page, typically another administrator inside the CMS backend. The EPSS score is 0.202% with a percentile of 10.297, reflecting a low predicted exploitation frequency despite the public disclosure.
Root Cause
The root cause is unsafe use of htmlspecialchars_decode on user-controllable input without corresponding output sanitization. Pluck CMS decodes HTML entities to display album descriptions but does not enforce a filtering layer, such as strip_tags or a context-aware escaping routine, before writing the value back into the page. This inversion of the standard htmlspecialchars protection strips away the encoding that normally neutralizes injected script tags. The result is a stored XSS sink located in an administrator-only workflow.
Attack Vector
Exploitation requires network access to the Pluck CMS instance and authenticated privileges sufficient to submit or edit album metadata, with user interaction to trigger the payload. An attacker with a low-privilege administrative account, or one obtained through phishing or credential reuse, submits a crafted Info parameter containing script content. When another operator navigates to the Albums administration view, the browser executes the injected code under the CMS origin. Public exploit details are referenced in the GitHub Issue #145 and the VulDB entry for CVE-2026-16205.
Detection Methods for CVE-2026-16205
Indicators of Compromise
- Album records in Pluck CMS containing HTML tags such as <script>, <img onerror=...>, or <svg onload=...> within the Info field.
- Outbound requests from administrator browsers to unfamiliar domains immediately after loading the Albums admin page.
- Web server logs showing POST requests to data/modules/albums/albums.admin.php with encoded payload characters (%3Cscript%3E, <) in the Info parameter.
Detection Strategies
- Inspect Pluck CMS album data on disk or in the database for markup fragments that do not belong in text descriptions.
- Deploy a Content Security Policy (CSP) in report-only mode to surface inline script executions originating from admin pages.
- Correlate authentication events with subsequent modifications to Albums Module records to identify suspicious editing sessions.
Monitoring Recommendations
- Enable verbose access logging on the Pluck CMS administrative endpoints and forward the logs to a centralized analytics platform.
- Alert on any HTTP request to albums.admin.php where the request body contains angle brackets or JavaScript event handler substrings.
- Track administrator session cookies for unusual reuse from new IP addresses, which may indicate token theft through XSS.
How to Mitigate CVE-2026-16205
Immediate Actions Required
- Restrict access to the Pluck CMS administration interface using IP allow-listing, VPN, or reverse-proxy authentication.
- Audit all existing album Info fields and remove any content containing HTML tags or JavaScript.
- Rotate administrator credentials and invalidate active sessions if suspicious album entries are found.
Patch Information
At the time of publication, the Pluck CMS project has not released a fix for CVE-2026-16205. The maintainers were notified through GitHub Issue #145 but have not responded. Monitor the Pluck CMS repository for future releases beyond version 4.7.21 that address the Albums Module sanitization gap. Additional tracking is available via the VulDB vulnerability entry #380021.
Workarounds
- Apply a Content Security Policy that disallows inline scripts (script-src 'self') on the Pluck CMS admin interface to blunt payload execution.
- Limit administrator accounts to a minimum trusted set and enforce multi-factor authentication to reduce the chance of an attacker obtaining the privileges needed to store a payload.
- Place the CMS behind a web application firewall configured to block requests containing script tags or event handler attributes in the Info parameter.
# Example CSP header for the Pluck CMS admin virtual host (Apache)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
