CVE-2026-32986

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improper sanitization of user-supplied input in Atom feed XML elements. Attackers can embed unescaped payloads in parameters such as category that are reflected into Atom fields like and , which execute as JavaScript when feed readers or CMS aggregators consume the feed and insert content into the DOM using unsafe methods.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-116

Affected software

Vendor	Product	Versions
Textpattern	Textpattern CMS	4.9.0

References

https://packetstorm.news/files/id/216241/Exploit, Issue Tracking
https://textpattern.com/Product

Timeline

Published: Mar 20, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-329879.8OpenClaw before 2026.3.13 allows bootstrap setup codes to be replayed during device pairing verification in src/infra/device-bootstrap.ts. A CVE-2026-329887.5OpenClaw before 2026.3.11 contains a sandbox boundary bypass vulnerability in fs-bridge staged writes where temporary file creation and popu CVE-2026-329898.8Precurio Intranet Portal 4.4 contains a cross-site request forgery vulnerability that allows attackers to induce authenticated users to subm CVE-2026-32996.4The WP YouTube Lyte plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'lyte' shortcode in all versions up t CVE-2026-329905.3Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. This issue affects Apache Tomcat: from CVE-2026-329917.1Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.CVE-2026-329928.2SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture CVE-2026-329938.3Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject ar CVE-2026-329945.3The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows CVE-2026-329957.5The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 CVE-2026-329967.3This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.CVE-2026-329978.6A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Rep