CVE-2026-32986 — Textpattern CMS 4.9.0: Second-Order XSS via Atom Feed Injection
Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improper sanitization of…
Published: 2026-03-20 · CVSS: 5.1 · CVSS 4.0
Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improper sanitization of user-supplied input in Atom feed XML elements. Attackers can embed unescaped payloads in parameters such as category that are reflected into Atom fields like and , which execute as JavaScript when feed readers or CMS aggregators consume the feed and insert content into the DOM using unsafe methods.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7