CVE-2025-44108

Published May 19th, 2025

View on NVD ↗

CVSS v3

4.8

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently.

flatpressblog/flatpress

FlatPress is a lightweight, easy-to-set-up flat-file blogging engine.

GitHub

209