Vulnerability · Published Jun 23, 2026 · Assigned by VulnCheck

CVE-2026-56785FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields

High 8.2

In plain English

A high-severity cross-site scripting in FlatPress from FlatPress. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.4%top 63.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in browsers of viewers including administrators, or bypass URL scheme validation to inject javascript: or data: URIs.

Affected products (as reported)

Vendor	Product	Versions
FlatPress	FlatPress	0 – before 10be83c

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

In plain English

Official description

Affected products (as reported)

References