Pluck-cms vulnerabilities
We track 7 vulnerabilities in Pluck-cms products across 2 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on August 5, 2026.
Latest Pluck-cms vulnerabilities
- 9.6 Critical severity
Pluck CMS: Cross-Site Request Forgery
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.
- 7.2 High severity
Pluck CMS: Unrestricted Upload of File with Dangerous Type
Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php ('.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar'), checked
- 7.2 High severity
Pluck: Unrestricted Upload of File with Dangerous Type
In Pluck CMS 4.7.20-dev, an authenticated attacker can upload or create a crafted PHP file under the albums module directory and access it via the module routing logic in albums.site.php, resulting in arbitrary command execution through a GET parameter.
- 8.8 High severity
Pluck: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary code via uploading a crafted ZIP file.
- 7.2 High severity
Pluck: Unrestricted Upload of File with Dangerous Type
An issue discovered in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev5 allows remote attackers to run arbitrary code via manage file functionality.
- 7.2 High severity
pluck-cms: Unrestricted Upload of File with Dangerous Type
Pluck CMS is vulnerable to an authenticated remote code execution (RCE) vulnerability through its “albums” module. Albums are used to create collections of images that can be inserted into web pages across the site. Albums allow the upload of various filetypes
- 8.8 High severity
Pluck: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to account takeover.