Second-Order XSS Vulnerability in Textpattern CMS 4.9.0

CVE-2026-32986

What is CVE-2026-32986?

A Second-Order Cross-Site Scripting (XSS) vulnerability is present in Textpattern CMS version 4.9.0 due to inadequate sanitization and contextual encoding of user-supplied input within Atom feed XML elements. It permits user-controlled parameters, like the category, to be reflected in Atom fields—specifically in and —without appropriate XML escaping. Although the payload may not directly execute in modern browsers when rendered in raw XML context, it poses a risk when processed by HTML-based feed readers, admin dashboards, or CMS aggregators that improperly handle feed content insertion into the DOM using unsafe methods such as innerHTML, leading to potential JavaScript execution in a trusted environment.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References