What’s Vulnerable › Vulnerabilities

CVE-2026-56785: FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-23 · updated 2026-06-25
• Weakness: CWE-79

Description

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in browsers of viewers including administrators, or bypass URL scheme validation to inject javascript: or data: URIs.

Affected products

• flatpressblog/flatpress: before 10be83c — fixed in 10be83c

How to fix

Upgrade to a fixed version: flatpressblog/flatpress 10be83c. Check the vendor advisory for mitigations.

References

• https://github.com/dilipk5/flatpressd-cms-sxss
• https://github.com/flatpressblog/flatpress/commit/10be83cbaac5ce0e51250b9d57de7f257b8f34f8
• https://www.vulncheck.com/advisories/flatpress-stored-cross-site-scripting-via-unescaped-comment-and-contact-form-fields

Get alerted when CVE-2026-56785 or the next vulnerability affects your stack