FlatPress CVE-2026-56785

The target FlatPress site must expose either the public comment form on a blog post or the contact form, both of which are enabled by default, and the attacker must be able to submit at least one comment/contact entry (no account required). Exploitation against an administrator additionally requires that the admin subsequently views the comment list in the admin panel or that another visitor loads the affected post page. Limiting factors: sites that have disabled commenting/contact, or that require pre-moderation by a user who never previews unmoderated content, materially reduce reachability; the bug is in the leggero theme template and admin comment list, so custom themes that already escape output may be unaffected.

The vendor CVSS 4.0 score of 8.4 (AV:N/AC:L/PR:N/UI:P/VC:H/VI:L/SC:H) reflects an unauthenticated, network-reachable stored XSS where the victim is most likely an authenticated administrator viewing the comment list - hence the high subsequent-system confidentiality impact (admin session/cookie theft, CMS takeover via the admin panel). User interaction is passive (UI:P) because simply viewing the affected page triggers the payload. EPSS and KEV signals were not provided in the input, and there is no public exploit identified at time of analysis, so this is not currently a mass-exploitation candidate; however, the disclosed patch diff effectively functions as an exploitation roadmap. Net real-world risk is moderate-to-high for any internet-exposed FlatPress instance accepting public comments, and lower for invitation-only or comment-disabled blogs.

An unauthenticated attacker submits a comment on a public FlatPress blog post, placing a payload such as a javascript: URI in the URL field or an HTML/script fragment in the name field. When an administrator later opens the admin comment-list panel - or any reader views the post's comments - the payload executes in their browser context and can exfiltrate session cookies, perform CSRF-style actions against the admin panel, or pivot to full site takeover. A public proof-of-concept write-up exists at github.com/dilipk5/flatpressd-cms-sxss.