CVE-2026-56785

HIGH SEVERITY

CVSS Score & Metrics

Base Score

8.2 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N                                    

Vulnerability Description

FlatPress versions prior to commit 10be83c, contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in browsers of viewers including administrators, or bypass URL scheme validation to inject javascript: or data: URIs.

Vulnerability Details

Published Date

June 23, 2026

Last Modified

June 23, 2026

CWE ID

CWE-79

Source

NVD

Vendor

FlatPress

Product

FlatPress

External References

https://github.com/dilipk5/flatpressd-cms-sxss
https://github.com/flatpressblog/flatpress/commit/10be83cbaac5ce0e51250b9d57de7f257b8f34f8
https://www.vulncheck.com/advisories/flatpress-stored-cross-site-scripting-via-unescaped-comment-and-contact-form-fields

CVE-2026-56785

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment