CVE-2026-56785
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk15th percentile — higher than 15% of all known CVEs
Summary
FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields.
Risk Assessment
Attackers can execute malicious scripts in the browsers of viewers, including administrators, which may lead to data theft or session hijacking. There is also a risk of bypassing URL scheme validation, allowing the injection of javascript: or data: URIs.
Recommendation
It is recommended to implement proper output encoding for all input data in forms and to review and update Smarty templates to prevent the injection of malicious code.
Original NVD description (English source)
FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in browsers of viewers including administrators, or bypass URL scheme validation to inject javascript: or data: URIs.