CVE-2018-16729

2018-09-1216:29:03

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.9%

JSON

Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files.

CPENameOperatorVersion
pluckeq4.7.4
pluckeq4.7.6
pluckeq4.7
pluckeq4.7.3
pluckeq4.744
pluckeq4.7.5-noversion
pluckeq4.7.2
pluckeq4.74
pluckeq4.74-dev5
pluckeq4.743

Name	Operator	Version
pluck	eq	4.7.4
pluck	eq	4.7.6
pluck	eq	4.7
pluck	eq	4.7.3
pluck	eq	4.744
pluck	eq	4.7.5-noversion
pluck	eq	4.7.2
pluck	eq	4.74
pluck	eq	4.74-dev5
pluck	eq	4.743

Rows per page:

1-10 of 141

References

github.com/pluck-cms/pluck/issues/63