CVE-2021-44082: Textpattern

High severity, CVSS 8.3. EPSS: 3% chance of exploitation in the next 30 days.

textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php,Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request.

Affected products

• Textpattern Textpattern: version 4.8.7 only

Published 2022-03-29. Last modified 2026-06-17.