Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
34 results
May 16, 2026TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the pluCVE-2021-47976 · Other software · Textpattern · reported by VulnCheckHigh 8.7
TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the plugin upload functionality. Attackers can authenticate, retrieve a CSRF token from the plugin event page, and upload malicious PHP files to the textpattern/tmp/ directory for code execution.
- Product
- TextPattern CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtextpattern.com
May 10, 2026TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious PHCVE-2021-47943 · Other software · Textpattern · reported by VulnCheckHigh 8.7
TextPattern CMS 4.8.7 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by uploading malicious PHP files through the file upload functionality. Attackers can upload a PHP shell via the Files section in the content area and execute commands by accessing the uploaded file at /textpattern/files/ with GET parameters passed to the system function.
- Product
- TextPattern CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Apr 21, 2026Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modCVE-2026-30452 · Other software · Textpattern · reported by MITREMedium 6.5
Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modify articles owned by users with higher privileges. By manipulating the article ID parameter during the duplicate-and-save workflow in textpattern/include/txp_article.php, an attacker can bypass authorization checks and overwrite content belonging to other users.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comtextpattern.com
Apr 2, 2026A security vulnerability has been detected in Textpattern up to 4.9.1.CVE-2026-5344 · Other software · reported by VulDBLow 2.1
A security vulnerability has been detected in Textpattern up to 4.9.1. Affected by this vulnerability is the function mt_uploadImage of the file rpc/TXP_RPCServer.php of the component XML-RPC Handler. The manipulation of the argument file.name leads to path traversal. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor confirmed the issue and will provide a fix in the upcoming release.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting impropeCVE-2026-32986 · Other software · Textpattern · reported by VulnCheckMedium 5.1
Textpattern CMS version 4.9.0 contains a second-order cross-site scripting vulnerability that allows attackers to inject malicious scripts by exploiting improper sanitization of user-supplied input in Atom feed XML elements. Attackers can embed unescaped payloads in parameters such as category that are reflected into Atom fields like and , which execute as JavaScript when feed readers or CMS aggregators consume the feed and insert content into the DOM using unsafe methods.
- Product
- Textpattern CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstorm.newstextpattern.com
Jan 23, 2026Textpattern versions prior to 4.8.3 contain an authenticated remote code execution vulnerability that allows logged-in users to upload malicious PHP files.CVE-2021-47888 · Other software · The Textpattern Development Team · reported by VulnCheckHigh 8.7
Textpattern versions prior to 4.8.3 contain an authenticated remote code execution vulnerability that allows logged-in users to upload malicious PHP files. Attackers can upload a PHP file with a shell command execution payload and execute arbitrary commands by accessing the uploaded file through a specific URL parameter.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtextpattern.comtextpattern.com
Dec 17, 2025Textpattern CMS 4.8.8 contains a stored cross-site scripting vulnerability in the article excerpt field that allows authenticated users to inject malicious scriCVE-2023-53911 · Other software · Tmrswrr · reported by VulnCheckMedium 5.1
Textpattern CMS 4.8.8 contains a stored cross-site scripting vulnerability in the article excerpt field that allows authenticated users to inject malicious scripts. Attackers can insert JavaScript payloads into the excerpt, which will execute when the article is viewed by other users.
- Product
- Textpattern CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtextpattern.comexploit-db.com
Dec 28, 2023There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions.CVE-2023-50038 · Other software · Textpattern · reported by MITREHigh 8.8
There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comcnblogs.com
Aug 7, 2023Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive informCVE-2023-36220 · Other software · Textpattern · reported by MITREHigh 7.2
Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comrelease-demo.textpattern.co
Apr 28, 2023An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute arbitrary code via a crafted Zip file.CVE-2023-24269 · Other software · Textpattern · reported by MITREHigh 8.8
An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute arbitrary code via a crafted Zip file.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 12, 2023An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by uploading a crafted PHCVE-2023-26852 · Other software · Textpattern · reported by MITREHigh 7.2
An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by uploading a crafted PHP file.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Jun 29, 2022Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php.CVE-2021-40642 · Other software · Textpattern · reported by MITREMedium 4.3
Textpattern CMS v4.8.7 and older vulnerability exists through Sensitive Cookie in HTTPS Session Without 'Secure' Attribute via textpattern/lib/txplib_misc.php. The secure flag is not set for txp_login session cookie in the application. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2022Textpattern 4.8.7 is affected by a HTML injection vulnerability through “Content>Write>Body”.CVE-2021-40658 · Other software · Textpattern · reported by MITREMedium 4.8
Textpattern 4.8.7 is affected by a HTML injection vulnerability through “Content>Write>Body”.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtanmay26.medium.comtanmay26.medium.com
Mar 29, 2022textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body.CVE-2021-44082 · Other software · Textpattern · reported by MITREHigh 8.3
textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest.co.ukcornerpirate.com
Aug 19, 2021A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attackers to execute arbitrCVE-2021-28002 · Other software · Textpattern · reported by MITREMedium 5.4
A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting the 'Articles' page.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comlinkedin.com
Aug 19, 2021A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code vCVE-2021-28001 · Other software · Textpattern · reported by MITREMedium 5.4
A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting https://site.com/articles/welcome-to-your-site#comments-head.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Jul 26, 2021Cross Site Scripting (XSS) vulnerability in Textpattern CMS 4.8.1 via Custom fields in the Menu Preferences feature.CVE-2020-23239 · Other software · Textpattern · reported by MITREMedium 4.8
Cross Site Scripting (XSS) vulnerability in Textpattern CMS 4.8.1 via Custom fields in the Menu Preferences feature.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2021Textpattern 4.7.3 contains an aribtrary file load via the file_insert function in include/txp_file.php.CVE-2020-19510 · Other software · Textpattern · reported by MITRECritical 9.8
Textpattern 4.7.3 contains an aribtrary file load via the file_insert function in include/txp_file.php.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.topsec.com.cnblog.topsec.com.cn
Apr 15, 2021Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security verification, which may CVE-2021-30209 · Other software · Textpattern · reported by MITREMedium 6.5
Textpattern V4.8.4 contains an arbitrary file upload vulnerability where a plug-in can be loaded in the background without any security verification, which may lead to obtaining system permissions.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter.CVE-2020-35854 · Other software · Textpattern · reported by MITREMedium 4.8
Textpattern 4.8.4 is affected by cross-site scripting (XSS) in the Body parameter.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordriteshgohil-25.medium.comtextpattern.co
Dec 2, 2020Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem.CVE-2020-29458 · Other software · Textpattern · reported by MITREHigh 8.8
Textpattern CMS 4.6.2 allows CSRF via the prefs subsystem.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Aug 14, 2020In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account.CVE-2015-8033 · Other software · Textpattern · reported by MITREMedium 5.3
In Textpattern 4.5.7, the password-reset feature does not securely tether a hash to a user account.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2020In Textpattern 4.5.7, an unprivileged author can change an article's markup setting.CVE-2015-8032 · Other software · Textpattern · reported by MITREMedium 5.3
In Textpattern 4.5.7, an unprivileged author can change an article's markup setting.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2018An issue was discovered in Textpattern CMS 4.6.2 and earlier.CVE-2018-7474 · Other software · Textpattern · reported by MITRECritical 9.8
An issue was discovered in Textpattern CMS 4.6.2 and earlier. It is possible to inject SQL code in the variable "qty" on the page index.php.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgexploit-db.com
Mar 13, 2018textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web serverCVE-2018-1000090 · Other software · Textpattern · reported by MITREHigh 7.5
textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 10, 2014Cross-site scripting (XSS) vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to setCVE-2014-4737 · Other software · Textpattern · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Textpattern CMS before 4.5.7 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to setup/index.php.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comtextpattern.com
Jan 5, 2012Cross-site scripting (XSS) vulnerability in setup/index.php in Textpattern CMS 4.4.1, when the product is incompletely installed, allows remote attackers to injCVE-2011-5019 · Other software · Textpattern · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in setup/index.php in Textpattern CMS 4.4.1, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the ddb parameter.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comsecurityfocus.com
Sep 23, 2011Textpattern 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error mCVE-2011-3807 · Other software · Textpattern · reported by MITREMedium 5
Textpattern 4.2.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by lib/txplib_db.php and certain other files.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.google.comcode.google.com
Sep 3, 2010PHP remote file inclusion vulnerability in index.php in Textpattern CMS 4.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc parametCVE-2010-3205 · Other software · Textpattern · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in index.php in Textpattern CMS 4.2.0 allows remote attackers to execute arbitrary PHP code via a URL in the inc parameter.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.orgexploit-db.com
Dec 30, 2008Cross-site scripting (XSS) vulnerability in textarea/index.php in Textpattern (aka Txp CMS) 4.0.6 and earlier allows remote authenticated users to inject arbitrCVE-2008-5757 · Other software · Textpattern · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in textarea/index.php in Textpattern (aka Txp CMS) 4.0.6 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Body parameter in an article action. NOTE: some of these details are obtained from third party information.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityfocus.com
Dec 18, 2008Textpattern (aka Txp CMS) 4.0.5 does not ask for the old password during a password reset, which makes it easier for remote attackers to change a password afterCVE-2008-5670 · Other software · Textpattern · reported by MITREMedium 6.8
Textpattern (aka Txp CMS) 4.0.5 does not ask for the old password during a password reset, which makes it easier for remote attackers to change a password after hijacking a session.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Dec 18, 2008index.php in the comments preview section in Textpattern (aka Txp CMS) 4.0.5 allows remote attackers to cause a denial of service via a long message parameter.CVE-2008-5669 · Other software · Textpattern · reported by MITREMedium 5
index.php in the comments preview section in Textpattern (aka Txp CMS) 4.0.5 allows remote attackers to cause a denial of service via a long message parameter.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Dec 18, 2008Multiple cross-site scripting (XSS) vulnerabilities in Textpattern (aka Txp CMS) 4.0.5 allow remote attackers to inject arbitrary web script or HTML via (1) theCVE-2008-5668 · Other software · Textpattern · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Textpattern (aka Txp CMS) 4.0.5 allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO to setup/index.php or (2) the name parameter to index.php in the comments preview section.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecurityreason.com
Oct 30, 2006PHP remote file inclusion vulnerability in publish.php in Textpattern 1.19, when register_globals is enabled, allows remote attackers to execute arbitrary PHP cCVE-2006-5615 · Other software · Textpattern · reported by MITREHigh 7.5
PHP remote file inclusion vulnerability in publish.php in Textpattern 1.19, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the txpcfg[txpath] parameter.
- Product
- Textpattern
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityreason.comsecurityfocus.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.