FlatPress vulnerabilities

CVEs whose affected-version data names the FlatPress package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-56785High· 8.2

3mo ago

FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaSc…

▾ TwilightFlatPress · FlatPressEPSS 0.42%via CVEORG