TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover (CVE-2026-55660) | HOL Guard CVE