PPluck CMS

Products

Exploited and recent CVEs

• CVE-2026-70376 Critical 9.6 Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE 0.2%
• CVE-2026-54416 High 7.2 Pluck CMS - Unrestricted File Upload via Missing .php8 Extension in Upload Blacklist 0.5%
• CVE-2024-9405 Medium 5.3 An incorrect limitation of a path to a restricted directory (path traversal) has been detected in Pluck CMS, affecting version 4.7.18. An unauthenticated attacker could extract sensitive information f 0.5%