Which versions of FlatPress are affected by CVE-2026-56785?

FlatPress contains a stored cross-site scripting (CVSS 8.4) vulnerability allowing unauthenticated attackers to inject malicious code through public comment and contact forms, with execution…. A patch is available.

How to fix or mitigate CVE-2026-56785?

Within 24 hours: Identify all FlatPress installations and verify current version (check if prior to commit 10be83c). Within 7 days: Deploy patch by updating FlatPress to the version including/after commit 10be83c on all affected systems. Within 30 days: Audit admin panel logs for suspicious activity; review and remove any injected content from comments and contact form submissions.

FlatPress CVE-2026-56785

Q: What is the CVSS score of CVE-2026-56785?

CVE-2026-56785 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38634 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-23 VulnCheck

GHSA-gf5w-3f8w-9fm6

XSS Flatpress

8.4

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network-reachable stored XSS submittable without auth (PR:N), requires a victim to view the affected page (UI:R), and the script executes in the admin's authenticated context, changing scope (S:C) with high confidentiality impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 23, 2026 - 22:46 vuln.today

Analysis Generated

Jun 23, 2026 - 22:46 vuln.today

DescriptionCVE.org

FlatPress versions prior to commit 10be83c, contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in browsers of viewers including administrators, or bypass URL scheme validation to inject javascript: or data: URIs.

AnalysisAI

Stored cross-site scripting in FlatPress (commits prior to 10be83c) allows unauthenticated remote attackers to inject persistent HTML and JavaScript via the name, URL, and email fields of comment and contact forms. The payloads execute in any viewer's browser - including administrators reviewing comments in the admin panel - and weak URL scheme validation additionally permits javascript: and data: URI injection. No public exploit identified at time of analysis, but the patch and a third-party advisory disclose the affected sinks in detail.

Technical ContextAI

FlatPress is a flat-file PHP blog engine that renders user-submitted comment metadata through Smarty templates. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the templates admin/panels/entry/admin.entry.commentlist.tpl and fp-interface/themes/leggero/comments.tpl interpolated $name, $url, and $email directly into HTML without an output-encoding modifier, and the comments.php / contact.php sanitize_*() helpers only enforced an http(s):// prefix substring check rather than parsing the URL and validating the scheme via parse_url(). The fix adds the wp_specialchars:1 Smarty modifier at the sinks and rewrites the URL sanitizer to reject control characters, HTML-significant bytes, and any scheme other than http/https. CPE coverage (cpe:2.3:a:flatpress:flatpress:*) lists all versions as affected up to the fix commit.

RemediationAI

Upstream fix available (commit 10be83c); released patched version not independently confirmed, so update FlatPress to a build that includes commit 10be83cbaac5ce0e51250b9d57de7f257b8f34f8 or later from https://github.com/flatpressblog/flatpress. As compensating controls until the upgrade is deployed, disable public commenting and the contact form in the FlatPress admin (eliminates the injection sinks but breaks reader engagement), require moderation of every comment before it appears (reduces window of exposure for admin viewers but does not protect the moderator themselves who views unmoderated comments), or apply the template change manually by adding the |wp_specialchars:1 Smarty modifier to $name, $url, and $email in admin/panels/entry/admin.entry.commentlist.tpl and fp-interface/themes/leggero/comments.tpl and backporting the parse_url-based scheme check in comments.php and contact.php. A site-wide Content-Security-Policy that forbids inline script and javascript:/data: URI navigation will blunt payload execution but may break legitimate themes or plugins that rely on inline handlers.