CVE-2023-53911

Textpattern CMS 4.8.8 Authenticated Stored Cross-Site Scripting via Article Excerpt

State: Published
Severity: 5.1 Medium
Published: Dec 17, 2025
Updated: Jul 28, 2026
Reserved: Dec 16, 2025

Description

Textpattern CMS 4.8.8 contains a stored cross-site scripting vulnerability in the article excerpt field that allows authenticated users to inject malicious scripts. Attackers can insert JavaScript payloads into the excerpt, which will execute when the article is viewed by other users.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N	VulnCheck
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	VulnCheck

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
Textpattern CMSTmrswrr	4.8.8Affected

References

ExploitDB-51523exploit
Official Product Webpageproduct
VulnCheck Advisory: Textpattern CMS 4.8.8 Authenticated Stored Cross-Site Scripting via Article Excerptthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.