Textpattern CMS Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in Textpattern CMS version 4.8.8. This issue resides in the article excerpt field, allowing authenticated users to inject malicious JavaScript scripts. The injected scripts execute when the article is viewed by other users.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the article.

Reproduction

To reproduce this vulnerability, log into an account with access to the admin panel. Navigate to the 'Content' section and select 'Articles'. Open an article for editing and locate the 'Excerpt' field. Insert a script payload, such as a JavaScript alert, into the excerpt. Save the article and then view it on the site. The script will execute, demonstrating the cross-site scripting vulnerability.