Flatpress vulnerabilities

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields.

Flatpress v1.2.1 was discovered to contain a reflected XSS vulnerability via the 'page' parameter in admin.php. An attacker can inject malicious JavaScript code that executes in the victim's browser.

Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function. An attacker can upload a malicious file, leading to arbitrary code execution on the server.