Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improper sanitization of user-supplied input in Atom feed XML elements. Attackers can embed unescaped payloads in parameters such as category that are reflected into Atom fields like and , which execute as JavaScript when feed readers or CMS aggregators consume the feed and insert content into the DOM using unsafe methods.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-20 | 2 | Disclosure2 |
| 2026-03-22 | 1 | Disclosure1 |
CVE-2026-32986 Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improper sani… https://www.cve.org/CVERecord?id=CVE-2026-32986
Post summary
A second‑order XSS vulnerability has been disclosed for Textpattern CMS 4.9.0, permitting attackers to inject malicious scripts through improper sanitization.
CVE-2026-32986 Second-Order Cross-Site Scripting in Textpattern CMS 4.9.... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-32986 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
This tweet announces the disclosure of CVE-2026-32986, a second‑order XSS vulnerability affecting Textpattern CMS 4.9, without providing PoC, exploit code, or patch information.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-32986 - Textpattern CMS 4.9.0: Second-Order XSS via Atom Feed Injection Intel Report: https://ift.tt/f2OdQoG
Post summary
The message discloses CVE-2026-32986 as a second‑order XSS vulnerability in Textpattern CMS 4.9.0 triggered by Atom Feed injection, with an associated intel report link.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | textpattern | textpattern | 4.9.0 | - | - |