Skip to content

Product

flatpress vulnerabilities

37 published CVES affecting flatpress, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
37
Critical
3
High
7
Medium
27
Low
0
Unscored
0
CISA KEV
0

Latest flatpress CVEs

Newest publication first · page 1 of 2

  2. CVE-2025-44108 A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a mali...

    Published
    MediumCVSS 4.8

    A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently.

  4. CVE-2024-4023 Stored XSS in flatpressblog/flatpress

    Published
    HighCVSS 8.1

    A stored cross-site scripting (XSS) vulnerability exists in flatpressblog/flatpress version 1.3. When a user uploads a file with a .xsig extension and directly accesses this file, the server responds with a Content-type of application/octet-stream, leading to the file being proce...

  5. CVE-2024-9699 Cross-Site Scripting (XSS) in flatpressblog/flatpress

    Published
    MediumCVSS 5.4

    A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting (XSS) attack if the uploaded file is accessed by other...

  6. CVE-2024-9847 Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress

    Published
    HighCVSS 8.0

    FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated user, will send a reque...

  7. CVE-2025-25460 A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript pay...

    Published
    MediumCVSS 4.8

    A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts, which are executed when other users view the posts. The i...

  22. CVE-2022-4822 FlatPress Setup main.lib.php cross site scripting

    Published
    MediumCVSS 6.1

    A vulnerability, which was classified as problematic, has been found in FlatPress. This issue affects some unknown processing of the file setup/lib/main.lib.php of the component Setup. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name...

  24. CVE-2022-4820 FlatPress Admin Area admin.entry.list.php cross site scripting

    Published
    MediumCVSS 6.1

    A vulnerability classified as problematic has been found in FlatPress. This affects an unknown part of the file admin/panels/entry/admin.entry.list.php of the component Admin Area. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.