CVE-2026-56785

High

Description

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in browsers of viewers including administrators, or bypass URL scheme validation to inject javascript: or data: URIs.

SeverityHigh

CVSS8.2

Exploit probability—

ProductFlatPress

PublishedJun 23, 2026

First seenJun 23, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

FlatPress FlatPress10be83c or later

Patches

github.com/flatpressblog/flatpress/commit/10be83cbaac5ce0e51250b9d57de7f257b8f34f8

Vendor advisories

github.com/dilipk5/flatpressd-cms-sxss

Affected products

Product	Affected versions	Fixed in
FlatPress FlatPress	v < 10be83c	10be83c

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.