CVE-2026-32986CWE-116CWE-79

Textpattern CMS 4.9.0: Second-Order XSS via Atom Feed Injection

Medium · published March 20, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improper sanitization of user-supplied input in Atom feed XML elements. Attackers can embed unescaped payloads in parameters such as category that are reflected into Atom fields like and , which execute as JavaScript when feed readers or CMS aggregators consume the feed and insert content into the DOM using unsafe methods.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00270 · 18.2th percentile
Weaknesses
CWE-116 · Improper Encoding or Escaping of Output; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-20T15:42Z
EPSS history
Timeline
  • 20 MAR 15:42Z
    Textpattern CMS 4.9.0: Second-Order XSS via Atom Feed Injection
    cvelistv5