CVE-2026-32986

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-32986
Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improper sanitization of user-supplied input in Atom feed XML elements. Attackers can embed unescaped payloads in parameters such as category that are reflected into Atom fields like and , which execute as JavaScript when feed readers or CMS aggregators consume the feed and insert content into the DOM using unsafe methods.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://packetstorm.news/files/id/216241/ Exploit Issue Tracking
https://textpattern.com/ Product
Configurations

Configuration 1 (hide)

cpe:2.3:a:textpattern:textpattern:4.9.0:-:*:*:*:*:*:*
History

16 Apr 2026, 14:44

Type Values Removed Values Added
Summary
  • (es) La versión 4.9.0 de Textpattern CMS contiene una vulnerabilidad de cross-site scripting de segundo orden que permite a los atacantes inyectar scripts maliciosos al explotar una sanitización inadecuada de la entrada proporcionada por el usuario en elementos XML de feeds Atom. Los atacantes pueden incrustar cargas útiles sin escapar en parámetros como category que se reflejan en campos Atom como y , que se ejecutan como JavaScript cuando los lectores de feeds o los agregadores de CMS consumen el feed e insertan contenido en el DOM utilizando métodos inseguros.
CPE cpe:2.3:a:textpattern:textpattern:4.9.0:-:*:*:*:*:*:*
First Time Textpattern textpattern
Textpattern
References () https://packetstorm.news/files/id/216241/ - () https://packetstorm.news/files/id/216241/ - Exploit, Issue Tracking
References () https://textpattern.com/ - () https://textpattern.com/ - Product

20 Mar 2026, 18:16

Type Values Removed Values Added
Summary (en) A Second-Order Cross-Site Scripting (XSS) vulnerability exists in Textpattern CMS version 4.9.0 due to improper sanitization and contextual encoding of user-supplied input embedded within Atom feed XML elements. User-controlled parameters (e.g., category) are reflected into Atom fields such as <id> and <link href> without proper XML escaping. While the payload may not execute directly in modern browsers in raw XML context, it can execute when the feed is consumed by HTML-based feed readers, admin dashboards, or CMS aggregators that insert the feed content into the DOM using unsafe methods (e.g., innerHTML), resulting in JavaScript execution in a trusted context. (en) Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improper sanitization of user-supplied input in Atom feed XML elements. Attackers can embed unescaped payloads in parameters such as category that are reflected into Atom fields like and , which execute as JavaScript when feed readers or CMS aggregators consume the feed and insert content into the DOM using unsafe methods.

20 Mar 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-20 16:16

Updated : 2026-04-16 14:44

NVD link : CVE-2026-32986

Mitre link : CVE-2026-32986

CVE.ORG link : CVE-2026-32986

JSON object : View

Products Affected

textpattern

  • textpattern
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-116

Improper Encoding or Escaping of Output