Stored Cross-Site Scripting in FlatPress by FlatPress Team

CVE-2026-56785

What is CVE-2026-56785?

FlatPress, a popular blogging software, is susceptible to a stored cross-site scripting (XSS) vulnerability in its comment and contact forms. This issue arises from the lack of adequate output encoding within Smarty templates, enabling attackers to inject arbitrary HTML and JavaScript into the fields for name, URL, and email. Consequently, these malicious scripts could execute in the browsers of users interacting with the compromised forms, including administrators. Moreover, attackers can exploit this flaw to bypass URL scheme validation, allowing the injection of javascript: or data: URIs, which heightens the risk of exploitation.

References