Textpattern - vulnerabilities (CVEs)

34 CVEs in 2 products, 0 in the last 30 days, newest from 2026-05-16.

Products

• Textpattern - 34 CVEs
• Textpattern Cms - 0 CVEs

Newest CVEs of Textpattern

• CVE-2021-47976 - CVSS 8.8 (high), 2026-05-16: TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the…
• CVE-2021-47943 - CVSS 8.8 (high), 2026-05-10: TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious…
• CVE-2026-30452 - CVSS 6.5 (medium), 2026-04-21: Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to…
• CVE-2026-5344 - CVSS 6.3 (medium), 2026-04-02: A security vulnerability has been detected in Textpattern up to 4.9.1. Affected by this vulnerability is the function mt_uploadImage of the file…
• CVE-2026-32986 - CVSS 6.1 (medium), 2026-03-20: Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting…
• CVE-2021-47888 - CVSS 8.8 (high), 2026-01-23: Textpattern versions prior to 4.8.3 contain an authenticated remote code execution vulnerability that allows logged-in users to upload malicious PHP files.…
• CVE-2023-53911 - CVSS 5.4 (medium), 2025-12-17: Textpattern CMS 4.8.8 contains a stored cross-site scripting vulnerability in the article excerpt field that allows authenticated users to inject malicious…
• CVE-2023-50038 - CVSS 8.8 (high), 2023-12-28: There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions.
• CVE-2023-36220 - CVSS 7.2 (high), 2023-08-07: Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive…
• CVE-2023-24269 - CVSS 8.8 (high), 2023-04-28: An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute arbitrary code via a crafted Zip file.
• CVE-2023-26852 - CVSS 7.2 (high), 2023-04-12: An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by uploading a crafted…
• CVE-2021-40642 - CVSS 4.3 (medium), 2022-06-29: Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via…
• CVE-2021-40658 - CVSS 4.8 (medium), 2022-06-14: Textpattern 4.8.7 is affected by a HTML injection vulnerability through “Content>Write>Body”.
• CVE-2021-44082 - CVSS 8.3 (high), 2022-03-29: textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger…
• CVE-2021-28001 - CVSS 5.4 (medium), 2021-08-19: A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code…
• CVE-2021-28002 - CVSS 5.4 (medium), 2021-08-19: A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attackers to execute…
• CVE-2020-23239 - CVSS 4.8 (medium), 2021-07-26: Cross Site Scripting (XSS) vulnerability in Textpattern CMS 4.8.1 via Custom fields in the Menu Preferences feature.
• CVE-2020-19510 - CVSS 9.8 (critical), 2021-06-21: Textpattern 4.7.3 contains an aribtrary file load via the file_insert function in include/txp_file.php.
• CVE-2021-30209 - CVSS 6.5 (medium), 2021-04-15: Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security verification, which…
• CVE-2020-35854 - CVSS 4.8 (medium), 2021-01-26: Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter.
• CVE-2020-29458 - CVSS 8.8 (high), 2020-12-02: Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem.
• CVE-2015-8033 - CVSS 5.3 (medium), 2020-08-14: In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account.
• CVE-2015-8032 - CVSS 5.3 (medium), 2020-08-14: In Textpattern 4.5.7, an unprivileged author can change an article's markup setting.
• CVE-2018-7474 - CVSS 9.8 (critical), 2018-03-14: An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php.
• CVE-2018-1000090 - CVSS 7.5 (high), 2018-03-13: textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web…
• CVE-2014-4737 - CVSS 4.3 (medium), 2014-10-10: Cross-site scripting (XSS) vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to…
• CVE-2011-5019 - CVSS 4.3 (medium), 2012-01-05: Cross-site scripting (XSS) vulnerability in setup/index.php in Textpattern CMS 4.4.1, when the product is incompletely installed, allows remote attackers to…
• CVE-2011-3807 - CVSS 5 (medium), 2011-09-24: Textpattern 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error…
• CVE-2010-3205 - CVSS 7.5 (high), 2010-09-03: PHP remote file inclusion vulnerability in index.php in Textpattern CMS 4.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc…
• CVE-2008-5757 - CVSS 3.5 (low), 2008-12-30: Cross-site scripting (XSS) vulnerability in textarea/index.php in Textpattern (aka Txp CMS) 4.0.6 and earlier allows remote authenticated users to inject…