Medium severity5.7NVD Advisory· Published May 4, 2026· Updated May 5, 2026

CVE-2026-31205

Description

Cross Site Scripting vulnerability in Pluck CMS before v.4.7.21dev allows a remote attacker to escalate privileges via the editpage.php and the sanitizePageContent function

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pluck/Pluckreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <4.7.21dev

Patches

Vulnerability mechanics

References

github.com/pluck-cms/pluck/blob/main/data/inc/editpage.phpnvd
github.com/pluck-cms/pluck/blob/main/data/inc/functions.all.phpnvd
github.com/pluck-cms/pluck/issues/141nvd
medium.com/@nakah_/pluck-cms-stored-xss-in-page-editor-cve-2026-31205-3b0526743e1dnvd

News mentions

No linked articles in our index yet.

cvss	0.371
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000