Textpattern Cms vulnerabilities

CVE-2021-47976 [HIGH] CWE-352 CVE-2021-47976: TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated a TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the plugin upload functionality. Attackers can authenticate, retrieve a CSRF token from the plugin event page, and upload malicious PHP files to the textpattern/tmp/ directory for code execution.

CVE-2021-47943 [HIGH] CWE-434 CVE-2021-47943: TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attac TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious PHP files through the file upload functionality. Attackers can upload a PHP shell via the Files section in the content area and execute commands by accessing the uploaded file at /textpattern/fil

CVE-2026-32986 [MEDIUM] CWE-79 CVE-2026-32986: Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improper sanitization of user-supplied input in Atom feed XML elements. Attackers can embed unescaped payloads in parameters such as category that are reflected into Atom fields like and , which exec