Which versions of Textpattern Cms are affected by CVE-2026-32986?

Organizations using Textpattern CMS should be aware of moderate risk from CVE-2026-32986, a cross-site scripting vulnerability rated CVSS 6.1.. A patch is available.

Is there a public PoC exploit available for CVE-2026-32986?

Yes, a public proof-of-concept exploit is available for CVE-2026-32986. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-32986?

Within 30 days: Identify affected systems running Textpattern CMS and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Textpattern Cms CVE-2026-32986

Q: What is the CVSS score of CVE-2026-32986?

CVE-2026-32986 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-13724 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 VulnCheck

XSS Textpattern Cms Textpattern

5.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 16, 2026 - 14:52 NVD

6.1 (MEDIUM) 5.1 (MEDIUM)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 24, 2026 - 15:54 vuln.today

Public exploit code

EUVD ID Assigned

Mar 20, 2026 - 15:52 euvd

EUVD-2026-13724

Analysis Generated

Mar 20, 2026 - 15:52 vuln.today

CVE Published

Mar 20, 2026 - 15:42 nvd

MEDIUM 6.1

DescriptionCVE.org

A Second-Order Cross-Site Scripting (XSS) vulnerability exists in Textpattern CMS version 4.9.0 due to improper sanitization and contextual encoding of user-supplied input embedded within Atom feed XML elements. User-controlled parameters (e.g., category) are reflected into Atom fields such as <id> and <link href> without proper XML escaping. While the payload may not execute directly in modern browsers in raw XML context, it can execute when the feed is consumed by HTML-based feed readers, admin dashboards, or CMS aggregators that insert the feed content into the DOM using unsafe methods (e.g., innerHTML), resulting in JavaScript execution in a trusted context.

AnalysisAI

A second-order XSS vulnerability exists in Textpattern CMS version 4.9.0 where user-supplied input (such as category parameters) is improperly sanitized and lacks contextual XML escaping in Atom feed XML elements like <id> and <link href>. While the payload does not execute directly in raw XML contexts within modern browsers, it becomes exploitable when feed readers, admin dashboards, or CMS aggregators consume the feed and insert its content into the DOM using unsafe methods like innerHTML, resulting in arbitrary JavaScript execution in a trusted context. A public proof-of-concept exploit is available, making this an active threat to administrators and users consuming feeds from vulnerable Textpattern instances.

Technical ContextAI

The vulnerability stems from a CWE-79 (Improper Neutralization of Input During Web Page Generation) classification where Textpattern CMS (identified via CPE cpe:2.3:a:textpattern:textpattern_cms) fails to properly escape or sanitize user-controlled parameters before embedding them into Atom feed XML structures. Atom feeds (RFC 4287) require proper XML entity encoding for special characters (<, >, &, quotes), but the application reflects unsanitized input directly into feed elements. The second-order nature of this XSS means the malicious payload is stored server-side (in the database or feed generation logic) and triggered when the feed is retrieved and processed by downstream consumers. Most modern browsers safely render raw XML feeds without executing embedded JavaScript; however, feed readers and web-based dashboard systems that parse the Atom feed and inject content into the DOM via innerHTML or similar unsafe methods become attack vectors. This distinction between safe XML parsing and unsafe DOM manipulation is critical to understanding the real-world impact.

RemediationAI

Immediately update Textpattern CMS to the patched version released by the vendor (consult https://textpattern.com/ for the specific version number and release date). The primary fix requires proper XML entity encoding of all user-supplied input before embedding it into Atom feed XML elements; developers should use language-native XML encoding functions (e.g., php xml_escape or equivalent) rather than generic HTML escaping. As an interim mitigation if immediate patching is not feasible, restrict access to feed endpoints using network-level controls (IP whitelisting, authentication requirements) and disable feed generation from user-controlled parameters until the patch is applied. Additionally, audit any downstream systems consuming Textpattern feeds (dashboards, aggregators, monitoring systems) to ensure they do not use innerHTML or similar unsafe DOM insertion methods; prefer safe alternatives like textContent or DOM APIs that do not interpret HTML/XML as executable code. Monitor feed consumption logs for suspicious access patterns or unusual category/parameter values that may indicate exploitation attempts.