CVE-2026-32986 Details

A second-order cross-site scripting vulnerability has been identified in Textpattern CMS version 4.9.0. This issue arises from inadequate sanitization and contextual encoding of user-supplied input within Atom feed XML elements. Parameters controlled by users, such as category, are reflected in Atom fields like <id> and <link href> without proper XML escaping. Although the injected payload may not execute directly in modern browsers due to the XML context, it can run when the feed is processed by HTML-based feed readers, admin dashboards, or CMS aggregators that incorporate the feed content into the DOM using unsafe methods, such as innerHTML. This results in the execution of JavaScript in a trusted context, potentially leading to session hijacking, credential theft, and exploitation of supply-chain vulnerabilities by targeting administrative users and trusted systems.

Users are advised to update to Textpattern CMS version 4.9.1, which addresses this vulnerability.