CVE WatchJul 19, 2026

CVE-2026-16205

A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/m

CVSS

2.4

Low

EPSS

0.2%

p10

KEV

—

Exploit Today

0-100

Published: Jul 19, 2026 · Last modified: Jul 19, 2026 · CWE-79 · CWE-94

EPSS · 30d

Not enough EPSS history yet.

Technical description

A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars_decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2025-32489.8 CRI

100.0%

KEV—80Langflow Missing Authentication Vulnerability5d CVE-2026-341978.8 HIG

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability5d CVE-2026-154107.2 HIG

71.1%

KEV—71SonicWall SMA1000 Appliances Code Injection Vulnerability4d CVE-2025-670389.8 CRI

55.3%

KEV—67Lantronix EDS5000 Code Injection Vulnerability14d CVE-2021-252996.1 MED

99.9%

——30Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server.11d CVE-2021-416539.8 CRI

99.5%

——30The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.11d