Stored XSS Vulnerability in Flatpress CMS Admin Panel
CVE-2025-44108
4.8MEDIUM
What is CVE-2025-44108?
A stored Cross-Site Scripting (XSS) vulnerability is present in the administration panel of Flatpress CMS prior to version 1.4. This vulnerability allows an attacker with admin privileges to inject a malicious JavaScript payload through the gallery captions component. Once the payload is injected, it gets stored persistently within the system, enabling the attacker to execute the script whenever the affected page is accessed, potentially compromising user security.
References
CVSS V3.1
Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved