CVE-2018-11330: Pluck-CMS Pluck

Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days.

An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted.

Affected products

• Pluck-CMS Pluck: before 4.7.6 (fixed in 4.7.6)

Published 2018-05-21. Last modified 2026-06-17.