CVE-2026-32986

Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improper sanitization of user-supplied input in Atom feed XML elements. Attackers can embed unescaped payloads in parameters such as category that are reflected into Atom fields like and , which execute as JavaScript when feed readers or CMS aggregators consume the feed and insert content into the DOM using unsafe methods.

Score
CVSS 3.1 6.1 Medium
Status
Analyzed - disclosure@vulncheck.com
Published
2026-03-20
Last modified
2026-07-14
Weaknesses
CWE-116, CWE-79

Affected products

References

 
 
© AVABIS GmbH privacypolicy about