CVE-2023-1148

Cross-site Scripting XSS - Stored in GitHub repository flatpressblog/flatpress prior to 1.3...

CVE-2023-1147

Cross-site Scripting XSS - Stored in GitHub repository flatpressblog/flatpress prior to 1.3...

CVE-2023-1106

Cross-site Scripting XSS - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3...

CVE-2023-0947

Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3...

CVE-2023-1105

External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3...

CVE-2023-1107

Cross-site Scripting XSS - Stored in GitHub repository flatpressblog/flatpress prior to 1.3...

CVE-2022-4755

A vulnerability was found in FlatPress and classified as problematic. This issue affects the function main of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component Media Manager Plugin. The manipulation of the argument mm-newgallery-name leads to cross site scriptin...

CVE-2022-40047

Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting XSS vulnerability via the page parameter at /flatpress/admin.php...

CVE-2022-4821

A vulnerability classified as problematic was found in FlatPress. This vulnerability affects the function onupload of the file admin/panels/uploader/admin.uploader.php of the component XML File Handler/MD File Handler. The manipulation leads to cross site scripting. The attack can be initiated...

CVE-2022-4822

A vulnerability, which was classified as problematic, has been found in FlatPress. This issue affects some unknown processing of the file setup/lib/main.lib.php of the component Setup. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is...

CVE-2022-4820

A vulnerability classified as problematic has been found in FlatPress. This affects an unknown part of the file admin/panels/entry/admin.entry.list.php of the component Admin Area. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patc...

CVE-2022-4748

A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component File Delete Handler. The manipulation of the argument deletefile leads to path traversal. The...

CVE-2022-4605

Cross-site Scripting XSS - Stored in GitHub repository flatpressblog/flatpress prior to 1.3...

CVE-2022-24588

Flatpress v1.2.1 was discovered to contain a cross-site scripting XSS vulnerability in the Upload SVG File function...

CVE-2022-40048

Flatpress v1.2.1 was discovered to contain a remote code execution RCE vulnerability in the Upload File function...

CVE-2020-35241

FlatPress 1.0.3 is affected by cross-site scripting XSS in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can steal the cookie...

CVE-2020-22761

Cross Site Request Forgery CSRF vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php...

CVE-2025-44108

A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently...

CVE-2025-44108

A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently...

PT-2025-21942 · Unknown · Flatpress Cms

Name of the Vulnerable Software and Affected Versions: Flatpress CMS versions prior to 1.4 Description: A stored Cross-Site Scripting XSS issue exists in the administration panel of Flatpress CMS via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScri...