PT-2026-26626 · Unknown · Textpattern Cms

Indoushka · Publicado 2026-03-20 · Atualizado 2026-03-22 · CVE-2026-32986

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Textpattern CMS version 4.9.0

Description Textpattern CMS version 4.9.0 is affected by a second-order cross-site scripting issue. This allows attackers to inject malicious scripts by exploiting improper sanitization of user-supplied input within Atom feed XML elements. Attackers can embed unescaped payloads in parameters such as category that are reflected into Atom fields like <title> and <link>, resulting in JavaScript execution when feed readers or CMS aggregators consume the feed and insert content into the Document Object Model (DOM) using unsafe methods.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Correção

Improper Encoding or Escaping of Output

XSS

Enumeração de Fraquezas

CWE-116

CWE-79

Identificadores relacionados

CVE-2026-32986

Produtos afetados

Textpattern Cms

Referências · 6

• 🔥 https://packetstorm.news/files/id/216241 · Exploit
• https://twitter.com/CVEnew/status/2035626971154026976 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2035035711460573646 · Publicação no Twitter
• https://textpattern.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-32986 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/2035107784434253996 · Publicação no Twitter