This vulnerability involves a Cross Site Scripting flaw in Pluck CMS prior to version 4.7.21dev. The issue arises in the editpage.php component and the sanitizePageContent function, which fail to properly sanitize input, enabling a remote attacker with some privileges to escalate their access. The CVSS 3.1 vector indicates high impact on confidentiality and integrity, requiring high privileges and user interaction, with network attack complexity being high.

Successful exploitation could allow an attacker with existing high privileges and user interaction to escalate their privileges further, potentially compromising confidentiality and integrity of the CMS content or administrative functions. However, the attack complexity is high and no known exploits are reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution with user inputs in editpage.php and consider restricting access to trusted users only. Monitor vendor channels for updates regarding patches or official mitigations.