CVE-2026-16205 is a cross-site scripting vulnerability affecting Pluck CMS up to version 4.7.21. The vulnerability is located in the Albums Module, specifically in the htmlspecialchars_decode function of the file data/modules/albums/albums.admin.php. Manipulating the Info argument can lead to XSS attacks, which can be triggered remotely. The vulnerability was reported early to the project, but no response or fix has been provided. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and low impact on integrity and availability.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking or other client-side attacks. The impact is rated medium with a CVSS score of 4.8. There is no indication of privilege escalation or direct system compromise from the provided data.

No official fix or patch is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a patch is released, consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting the Albums Module or restrict access to the affected functionality if feasible.