CVE-2022-40047

MediumCVSS 5.4

Published: 11/10/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.13%

63th percentile - higher than 63% of all known CVEs

Summary

Flatpress v1.2.1 was discovered to contain a reflected XSS vulnerability via the 'page' parameter in admin.php. An attacker can inject malicious JavaScript code that executes in the victim's browser.

Risk Assessment

The risk includes potential session hijacking of administrators, redirection to malicious sites, or unauthorized actions in the admin panel.

Recommendation

Immediately update Flatpress to the latest version and apply input filtering for the 'page' parameter in admin.php.

Original NVD description (English source)

Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.