FlatPress vulnerabilities
We track 4 vulnerabilities in FlatPress products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on June 23, 2026.
Latest FlatPress vulnerabilities
- 8.2 High severity
FlatPress: Improper Neutralization of Input During Web Page Generation
FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fiel
- 8.0 High severity
flatpressblog/flatpress: Cross-Site Request Forgery
FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated use
- 8.1 High severity
flatpressblog/flatpress: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting (XSS) vulnerability exists in flatpressblog/flatpress version 1.3. When a user uploads a file with a `.xsig` extension and directly accesses this file, the server responds with a Content-type of application/octet-stream, leading t
- 9.8 Critical severity
FlatPress: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component File Delete Handler. The manipulation of the argument de