Pluck

Records8All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

Pluck records in CISA KEV

No Pluck vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Pluck 5 records LOW

Records

8 records

TI-2023-04615 CVE-2023-5013 · GHSA-p69j-9595-rm77

Pluck CMS Installation install.php cross site scripting

MEDIUM 58

A vulnerability has been found in Pluck CMS 4.7.18 and classified as problematic.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00574 Published 2023-09-16 No fix listed CWE-79

TI-2026-13546 CVE-2026-16205 · GHSA-9q2q-q44g-f28v

Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting

MEDIUM 55

A weakness has been identified in Pluck CMS up to 4.7.21.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.0035 Published 2026-07-19 No fix listed CWE-79

TI-2023-11098 CVE-2023-25828 · GHSA-cp9w-xxfq-xfcf

Authenticate Remote Code Execution in Pluck CMS

LOW 35

Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01564 Published 2023-03-27 No fix listed CWE-434

TI-2008-03056 CVE-2008-3194 · GHSA-qpjg-r2f6-r5rc

Multiple directory traversal vulnerabilities in data/inc/themes/predefined_variables.php…

LOW 35

Multiple directory traversal vulnerabilities in data/inc/themes/predefined_variables.php in pluck 4.5.1 allow remote attackers to include and execute arbitrary local files via a ..

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02551 Published 2008-07-16 No fix listed CWE-22

TI-2008-03690 CVE-2008-3851 · GHSA-g567-gmj2-gq25

Multiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote…

LOW 34

Multiple directory traversal vulnerabilities in Pluck CMS 4.5.2 on Windows allow remote attackers to include and execute arbitrary local files via a ..\ (dot dot backslash) in the (1) blogpost, (2) cat, and (3) file para…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07936 Published 2008-08-27 No fix listed CWE-22

TI-2007-04048 CVE-2007-4181 · GHSA-c345-8824-6347

PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when…

LOW 33

PHP remote file inclusion vulnerability in data/inc/theme.php in Pluck 4.3, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the dir parameter.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01553 Published 2007-08-08 No fix listed

TI-2007-04047 CVE-2007-4180 · GHSA-hg68-h73w-q4qq

Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3, when…

LOW 26

Directory traversal vulnerability in data/inc/theme.php in Pluck 4.3, when register_globals is enabled, allows remote attackers to read arbitrary local files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01479 Published 2007-08-08 No fix listed

TI-2008-03421 CVE-2008-3574 · GHSA-vh5p-g64v-2w64

Multiple cross-site scripting (XSS) vulnerabilities in Pluck 4.5.2, when register_globals…

LOW 16

Multiple cross-site scripting (XSS) vulnerabilities in Pluck 4.5.2, when register_globals is enabled, allow remote attackers to inject arbitrary web script or HTML via the (1) lang_footer parameter to (a) data/inc/footer…

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.01513 Published 2008-08-10 No fix listed CWE-79

Open these records in search →

Critical	0
High	1
Medium	6
Low	1
No CVSS	0