Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in browsers of viewers including administrators, or bypass URL scheme validation to inject javascript: or data: URIs.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-23 | 2 | Disclosure2 |
| 2026-06-24 | 1 | Patch1 |
🚨 HIGH: CVE-2026-56785 (CVSS 8.2) - Stored XSS in FlatPress CMS affects comment/contact forms. Attackers can inject malicious scripts via name, URL, email fields. Update to commit 10be83c+ immediately. #CVE #PatchNow #ThreatIntel https://t.co/55UXiSa8aO
Post summary
A high‑severity stored XSS vulnerability (CVE‑2026‑56785) in FlatPress CMS is disclosed, with a specific patch commit recommended; no PoC or active exploitation is reported.
🚨*CVE* CVE-2026-56785 FlatPress versions prior to commit 10be83c, contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are re… https://www.cve.org/CVERecord?id=CVE-2026-56785 ----- Traducción: CVE-2026-56785 Fla… http://infoflow.cloud`
Post summary
The post announces a stored XSS vulnerability in FlatPress’s comment and contact forms, referencing the CVE record for further detail.
CVE-2026-56785 FlatPress versions prior to commit 10be83c, contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are re… https://www.cve.org/CVERecord?id=CVE-2026-56785
Post summary
CVE‑2026‑56785 is a stored XSS issue in FlatPress comment/contact forms; the vulnerability is disclosed, with a patch commit (10be83c) referenced.