FlatPress versions prior to the commit 10be83c store the name, URL, and email fields from comments and contact forms without proper output encoding in Smarty templates, creating a stored cross‑site scripting flaw. An attacker can submit malicious HTML or JavaScript through these fields, which is later rendered when a page containing the stored comment or contact form is viewed, allowing the script to execute in the victim’s browser. The vulnerability also permits bypassing URL scheme validation, enabling injection of javascript: or data: URIs.

All installations of FlatPress running a version before the commit 10be83c are affected. The flaw exists in the core application and is present regardless of the site’s configuration, meaning any publicly accessible comment or contact form is exploitable.

The CVSS score of 8.4 indicates high severity. EPSS data is not available and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be through normal user interaction; a malicious user can submit a comment or contact entry containing XSS payloads that are stored and later executed when the page is viewed. Administrators are impacted because their browsers will execute the stored script upon visiting the site. No evidence of active exploitation is present in the CVE description, so the primary risk is the potential for widespread XSS if the flaw is utilized.