Typemill CMS 2.x contains a persistent XSS vulnerability (CVE-2026-44401) in the Markdown parser extension. Authenticated users with theme-configuration privileges can supply unsanitized href attributes in Markdown links, including javascript: scheme URIs, through ParsedownExtension.php or TwigMarkdownExtension.php. This results in persistent malicious JavaScript being stored and executed in the browsers of users who click the links, enabling theft of session cookies, authenticated request forgery, and credential harvesting.

The vulnerability allows attackers with authenticated theme-configuration access to inject persistent malicious JavaScript code that executes in the context of users visiting the affected site. This can lead to session cookie theft, forged authenticated requests, and harvesting of user credentials. The CVSS score is 4.8 (medium severity), reflecting the need for authentication and user interaction for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict theme-configuration access to trusted users only and avoid clicking suspicious Markdown links. Monitor vendor channels for updates and apply official patches once released.