CVE-2026-56785
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields.
Risk Assessment
Attackers can execute malicious scripts in the browsers of viewers, including administrators, which may lead to data theft or session hijacking. There is also a risk of bypassing URL scheme validation, allowing the injection of javascript: or data: URIs.
Recommendation
It is recommended to implement proper output encoding for all input data in forms and to review and update Smarty templates to prevent the injection of malicious code.
Other vulnerabilities in FlatPress
See all- CVE-2022-40047Medium
Flatpress v1.2.1 was discovered to contain a reflected XSS vulnerability via the 'page' parameter in admin.php. An attacker can inject malicious JavaScript code that executes in the victim's browser.
- CVE-2022-40048High
Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function. An attacker can upload a malicious file, leading to arbitrary code execution on the server.
Original NVD description (English source)
FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in browsers of viewers including administrators, or bypass URL scheme validation to inject javascript: or data: URIs.