PT-2026-26626 · Unknown · Textpattern Cms

Indoushka · Published 2026-03-20 · Updated 2026-03-22 · CVE-2026-32986

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Textpattern CMS version 4.9.0

Description Textpattern CMS version 4.9.0 is affected by a second-order cross-site scripting issue. This allows attackers to inject malicious scripts by exploiting improper sanitization of user-supplied input within Atom feed XML elements. Attackers can embed unescaped payloads in parameters such as category that are reflected into Atom fields like <title> and <link>, resulting in JavaScript execution when feed readers or CMS aggregators consume the feed and insert content into the Document Object Model (DOM) using unsafe methods.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

CVE-2026-32986

Affected Products

Textpattern Cms

References · 6

• 🔥 https://packetstorm.news/files/id/216241 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-32986 · Security Note
• https://twitter.com/CVEnew/status/2035626971154026976 · Twitter Post
• https://twitter.com/cyberbivash/status/2035035711460573646 · Twitter Post
• https://textpattern.com · Note
• https://twitter.com/VulmonFeeds/status/2035107784434253996 · Twitter Post