CVE-2026-16205

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-16205

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16205.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-16205

Published

2026-07-19T02:00:09Z

Modified

2026-08-12T03:51:47Z

Severity

1.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting

Details

A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-79",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/16xxx/CVE-2026-16205.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "4.7.0"
                },
                {
                    "last_affected": "4.7.0"
                },
                {
                    "introduced": "4.7.1"
                },
                {
                    "last_affected": "4.7.1"
                },
                {
                    "introduced": "4.7.21"
                },
                {
                    "last_affected": "4.7.21"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/pluck-cms/pluck

Affected ranges

Type

GIT

Repo

https://github.com/pluck-cms/pluck

Events

Introduced

37e3bf5b43dd8f9209c8e677649c1b78f57420d2

Last Affected

d1d25e23e078c12057c92312a4564e026b09e349

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "4.7.2"
        },
        {
            "last_affected": "4.7.2"
        },
        {
            "introduced": "4.7.3"
        },
        {
            "last_affected": "4.7.3"
        },
        {
            "introduced": "4.7.4"
        },
        {
            "last_affected": "4.7.4"
        },
        {
            "introduced": "4.7.5"
        },
        {
            "last_affected": "4.7.5"
        },
        {
            "introduced": "4.7.6"
        },
        {
            "last_affected": "4.7.6"
        },
        {
            "introduced": "4.7.7"
        },
        {
            "last_affected": "4.7.7"
        },
        {
            "introduced": "4.7.8"
        },
        {
            "last_affected": "4.7.8"
        },
        {
            "introduced": "4.7.9"
        },
        {
            "last_affected": "4.7.9"
        },
        {
            "introduced": "4.7.10"
        },
        {
            "last_affected": "4.7.10"
        },
        {
            "introduced": "4.7.11"
        },
        {
            "last_affected": "4.7.11"
        },
        {
            "introduced": "4.7.12"
        },
        {
            "last_affected": "4.7.12"
        },
        {
            "introduced": "4.7.13"
        },
        {
            "last_affected": "4.7.13"
        },
        {
            "introduced": "4.7.14"
        },
        {
            "last_affected": "4.7.14"
        },
        {
            "introduced": "4.7.15"
        },
        {
            "last_affected": "4.7.15"
        },
        {
            "introduced": "4.7.16"
        },
        {
            "last_affected": "4.7.16"
        },
        {
            "introduced": "4.7.17"
        },
        {
            "last_affected": "4.7.17"
        },
        {
            "introduced": "4.7.18"
        },
        {
            "last_affected": "4.7.18"
        },
        {
            "introduced": "4.7.19"
        },
        {
            "last_affected": "4.7.19"
        },
        {
            "introduced": "4.7.20"
        },
        {
            "last_affected": "4.7.20"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

4.*

4.7

4.7.10

4.7.10-dev1

4.7.10-dev2

4.7.10-dev3

4.7.10-dev4

4.7.10-dev5

4.7.11

4.7.11-dev1

4.7.11-dev2

4.7.12

4.7.12-dev1

4.7.12-dev2

4.7.13

4.7.14

4.7.14-dev1

4.7.15

4.7.15-dev1

4.7.16

4.7.16-dev1

4.7.16-dev2

4.7.16-dev3

4.7.16-dev4

4.7.16-dev5

4.7.16-dev6

4.7.17

4.7.17-1

4.7.18

4.7.19

4.7.19-dev1

4.7.19-dev2

4.7.2

4.7.20

4.7.20-dev1

4.7.20-dev2

4.7.3

4.7.4

4.7.5

4.7.5-noversion

4.7.6

4.7.7

4.7.7-dev1

4.7.7-dev2

4.7.8

4.7.8-dev1

4.7.8-dev2

4.7.8-dev3

4.7.9

4.7.9-dev1

4.7.9-dev2

4.7.9-dev3

4.7.9-dev4

4.74

4.74-dev5

4.743

v4.*

v4.7.4

v4.744

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-16205.json"