CVE-2026-56785 | High | 8.2 | 2026-06-23 | FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper outpu… |
CVE-2025-44108 | Medium | 4.8 | 2025-05-19 | A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacke… |
CVE-2025-29602 | Medium | 6.1 | 2025-05-07 | flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories. |
CVE-2024-9847 | High | 8.0 | 2025-03-20 | FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a vict… |
CVE-2024-9699 | Medium | 5.4 | 2025-03-20 | A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payloa… |
CVE-2024-4023 | High | 8.1 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in flatpressblog/flatpress version 1.3. When a user uploads a file with a `.xsig` extension and direct… |
CVE-2025-25460 | Medium | 4.8 | 2025-02-24 | A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated att… |
CVE-2024-41290 | High | 8.1 | 2024-10-02 | FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component. |
CVE-2024-33210 | Medium | 5.4 | 2024-10-02 | A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3. This vulnerability allows an attacker to inject malicious scripts into web pag… |
CVE-2024-33209 | Medium | 5.4 | 2024-10-02 | FlatPress v1.3 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into the "Add New Entry" section, which allows the… |
CVE-2024-31835 | Medium | 4.8 | 2024-10-01 | Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the file name pa… |
CVE-2024-25412 | Medium | 6.1 | 2024-09-27 | A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2024-25411 | Medium | 6.1 | 2024-09-27 | A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2023-1148 | Medium | 4.8 | 2023-03-02 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-1147 | Medium | 5.4 | 2023-03-02 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-1146 | Medium | 5.4 | 2023-03-02 | Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-1107 | Medium | 5.4 | 2023-03-02 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-1106 | Medium | 6.1 | 2023-03-02 | Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-1105 | High | 8.1 | 2023-03-01 | External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-1104 | Medium | 5.4 | 2023-03-01 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2023-0947 | Critical | 9.8 | 2023-02-22 | Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2022-4822 | Low | 2.4 | 2022-12-28 | A vulnerability, which was classified as problematic, has been found in FlatPress. This issue affects some unknown processing of the file setup/lib/main.lib.ph… |
CVE-2022-4821 | Low | 2.4 | 2022-12-28 | A vulnerability classified as problematic was found in FlatPress. This vulnerability affects the function onupload of the file admin/panels/uploader/admin.uplo… |
CVE-2022-4820 | Low | 3.5 | 2022-12-28 | A vulnerability classified as problematic has been found in FlatPress. This affects an unknown part of the file admin/panels/entry/admin.entry.list.php of the… |
CVE-2022-4755 | Low | 3.5 | 2022-12-27 | A vulnerability was found in FlatPress and classified as problematic. This issue affects the function main of the file fp-plugins/mediamanager/panels/panel.med… |
CVE-2022-4748 | Medium | 5.5 | 2022-12-27 | A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/… |
CVE-2022-4605 | Medium | 5.4 | 2022-12-18 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2022-4606 | Critical | 9.8 | 2022-12-18 | PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2022-40047 | Medium | 5.4 | 2022-10-11 | Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php. |
CVE-2022-40048 | High | 7.2 | 2022-09-29 | Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function. |
CVE-2021-41432 | Medium | 5.4 | 2022-06-23 | A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands through blog content. |
CVE-2022-24588 | Medium | 5.4 | 2022-02-15 | Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function. |
CVE-2020-22761 | High | 8.8 | 2021-07-30 | Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php. |
CVE-2020-35241 | Medium | 4.8 | 2020-12-30 | FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in… |
CVE-2014-100036 | | | 2015-01-13 | Cross-site scripting (XSS) vulnerability in FlatPress 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the content parameter to the def… |
CVE-2009-4461 | | | 2009-12-30 | Multiple cross-site scripting (XSS) vulnerabilities in FlatPress 0.909 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) c… |
CVE-2008-4120 | | | 2008-09-29 | Multiple cross-site scripting (XSS) vulnerabilities in FlatPress 0.804 allow remote attackers to inject arbitrary web script or HTML via the (1) user or (2) pa… |