CVE-2022-40047
MediumCVSS 5.4Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
Flatpress v1.2.1 was discovered to contain a reflected XSS vulnerability via the 'page' parameter in admin.php. An attacker can inject malicious JavaScript code that executes in the victim's browser.
Risk Assessment
The risk includes potential session hijacking of administrators, redirection to malicious sites, or unauthorized actions in the admin panel.
Recommendation
Immediately update Flatpress to the latest version and apply input filtering for the 'page' parameter in admin.php.
Other vulnerabilities in Flatpress
See all- CVE-2026-56785High
FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields.
- CVE-2022-40048High
Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function. An attacker can upload a malicious file, leading to arbitrary code execution on the server.
Original NVD description (English source)
Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS