Description (CNA)
Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improper sanitization of user-supplied input in Atom feed XML elements. Attackers can embed unescaped payloads in parameters such as category that are reflected into Atom fields like and , which execute as JavaScript when feed readers or CMS aggregators consume the feed and insert content into the DOM using unsafe methods.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Textpattern / Textpattern CMS | affected 4.9.0 |
CWE
CWE-79, CWE-116
References
ADP enrichment
No English description supplied.
No references supplied.