EIP-2026-111353

This exploit demonstrates an HTML injection vulnerability in Pluck CMS, where user-supplied input is not properly sanitized. The PoC includes a form with a hidden input field containing a script tag that triggers an alert with the document cookie, confirming the XSS vulnerability.