CVE-2026-32986 is a second-order cross-site scripting vulnerability in Textpattern CMS version 4.9.0. It arises from improper neutralization of user-supplied input in Atom feed XML elements, specifically in parameters like category. Malicious payloads embedded in these parameters are reflected into Atom feed fields without proper escaping, leading to script execution when the feed is processed by readers or aggregators that insert content into the DOM using unsafe methods. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-116 (Improper Encoding or Escaping of Output).

An attacker can inject malicious JavaScript code into Atom feed XML elements that are later executed in the context of feed readers or CMS aggregators consuming the feed. This can lead to cross-site scripting attacks, potentially compromising user sessions or performing unauthorized actions within the context of the feed-consuming application. The vulnerability requires user interaction (UI:A) and has low vector complexity (AC:L). There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is documented, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting or sanitizing user input that can be included in Atom feeds, or limit the use of Atom feeds in environments where untrusted input is present. Avoid using feed readers or aggregators that insert feed content into the DOM without proper sanitization.