CVE-2008-3574: Multiple cross-site scripting (XSS) vulnerabilities in Pluck 4.5.2, when register_globals is enabled, allow...

Security readout for executives and security teams

This is an old cross-site scripting issue in Pluck 4.5.2 that depends on PHP register_globals being enabled. An exposed site could allow an attacker to inject script or HTML into pages, potentially affecting users or administrators who view the malicious content. Exposure is most likely on legacy Pluck 4.5.2 installations where PHP register_globals is enabled. The bundle does not identify broader affected versions, package names, default configurations, or hosted-service exposure. Treat as a legacy web-application exposure review rather than an emergency unless Pluck 4.5.2 is internet-facing. Prioritize remediation if administrators use the affected site, because XSS can support credential theft, session abuse, or malicious content injection. Mitigation focus: Inventory internet-facing sites for Pluck 4.5.2.; Disable PHP register_globals where still present.; Check vendor or project guidance for fixed versions or replacement paths..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.