CVE-2026-56785: FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields
FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in browsers of viewers including administrators, or bypass URL scheme validation to inject javascript: or data: URIs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FlatPressto a version that resolves this vulnerability.Patch commit 10be83c
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56785?
CVE-2026-56785 has a high severity score of 8.2.
How do I fix CVE-2026-56785?
To fix CVE-2026-56785, update FlatPress to the version following commit 10be83c.
What is the risk associated with CVE-2026-56785?
CVE-2026-56785 poses a risk of stored cross-site scripting (XSS) through unescaped fields in comments and contact forms.
What types of fields are vulnerable in CVE-2026-56785?
The vulnerable fields in CVE-2026-56785 include name, URL, and email fields in comment and contact forms.
What impact can CVE-2026-56785 have on users?
CVE-2026-56785 allows attackers to inject arbitrary HTML and JavaScript, potentially leading to unauthorized actions by users.