CVE-2026-56785: FlatPress Stored XSS Vulnerability

CVE-2026-56785 Overview

FlatPress contains a stored cross-site scripting (XSS) vulnerability in its comment and contact forms. The name, url, and email fields submitted through these forms are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in the browsers of visitors and administrators viewing the affected pages. The flaw also permits URL scheme validation bypass, allowing attackers to inject javascript: or data: URIs into rendered links. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can store malicious JavaScript that executes in administrator sessions, enabling account takeover and full compromise of the FlatPress site.

Affected Products

FlatPress CMS (versions prior to commit 10be83cbaac5ce0e51250b9d57de7f257b8f34f8)
FlatPress comment functionality rendered via admin/panels/entry/admin.entry.commentlist.tpl
FlatPress contact form URL handling in comments.php

Discovery Timeline

2026-06-23 - CVE-2026-56785 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-56785

Vulnerability Analysis

The vulnerability resides in how FlatPress renders user-submitted comment and contact form data. The Smarty template admin.entry.commentlist.tpl outputs the $name, $url, and $email variables directly into HTML without applying any escaping filter. When an administrator views the comment moderation panel, any JavaScript embedded in those fields executes in the administrator's authenticated session.

In parallel, the ensure_https_url() function in comments.php relies on filter_var($url, FILTER_VALIDATE_URL) together with a denylist for file, php, data, and ftp schemes. The denylist approach is incomplete and the validation does not strip control characters or quote characters, which permits attackers to craft URLs that break out of the href attribute or use alternate dangerous schemes.

Root Cause

The root cause is the absence of output encoding in Smarty templates combined with denylist-based URL scheme validation. User input flows from form submission to persistent storage and then to rendered HTML without contextual escaping at the output sink, violating standard XSS prevention practices.

Attack Vector

An unauthenticated remote attacker submits a comment or contact message containing JavaScript payloads in the name, URL, or email fields. The payload is stored and later rendered to any user viewing the comment list, including site administrators. User interaction is limited to visiting the affected page.

text

// Patch in admin/panels/entry/admin.entry.commentlist.tpl
<td>{$date|date_format:"%D, %T"}</td>
<td class="main_cell">{$content|strip_tags|truncate:70}</td>
-<td>{if $url}<a href="{$url}">{$name}</a>{else}{$name}{/if}</td>
-<td><a href="mailto:{$email}">{$email}</a></td>
+<td>{if $url}<a href="{$url|wp_specialchars:1}">{$name|wp_specialchars:1}</a>{else}{$name|wp_specialchars:1}{/if}</td>
+<td><a href="mailto:{$email|wp_specialchars:1}">{$email|wp_specialchars:1}</a></td>
<td>{$ip_address}</td>

Source: GitHub Commit 10be83c

The fix applies the wp_specialchars:1 filter to each user-controlled variable, encoding HTML special characters at the output layer.

Detection Methods for CVE-2026-56785

Indicators of Compromise

Stored comment records containing <script>, onerror=, onload=, or other HTML event handlers in the name, url, or email fields.
Comment URL fields containing javascript:, data:, or other non-http(s) schemes.
Outbound requests from administrator browsers to attacker-controlled domains shortly after viewing the comment moderation panel.
Unexpected administrator account changes or new admin users created without corresponding authenticated admin sessions.

Detection Strategies

Inspect the FlatPress comment data store for entries whose name, url, or email fields contain HTML tags, angle brackets, or non-HTTP URL schemes.
Deploy a web application firewall (WAF) rule that blocks comment submissions containing common XSS payload patterns.
Review web server access logs for POST requests to comment and contact endpoints with suspicious payloads in form parameters.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script execution attempts in the admin panel.
Monitor administrator session activity for anomalous requests originating immediately after comment moderation page loads.
Alert on creation of new administrator accounts or modifications to user privilege records.

How to Mitigate CVE-2026-56785

Immediate Actions Required

Apply the upstream FlatPress patch from commit 10be83cbaac5ce0e51250b9d57de7f257b8f34f8 to all production instances.
Audit existing stored comments and contact submissions and remove or sanitize any entries containing HTML or non-HTTP URL schemes.
Force password resets for all FlatPress administrator accounts in case session tokens were captured.

Patch Information

The FlatPress project resolved the vulnerability in commit 10be83cbaac5ce0e51250b9d57de7f257b8f34f8. The patch escapes $name, $url, and $email with the wp_specialchars:1 Smarty filter in the comment list template and hardens the ensure_https_url() function in comments.php with strict scheme allowlisting via parse_url() and rejection of control characters and quote characters. See the VulnCheck Security Advisory for full details.

Workarounds

Temporarily disable comment and contact form submissions until the patch is applied.
Restrict access to the FlatPress admin panel by IP address using web server configuration.
Deploy a WAF rule that strips or blocks HTML tags and javascript:/data: schemes in comment field submissions.

php

// Hardened ensure_https_url() from the official patch
function ensure_https_url($url) {
    $url = trim(stripslashes((string)$url));
    if ($url === '') {
        return '';
    }
    if (!preg_match('/^https?:\/\//i', $url)) {
        $url = 'https://' . $url;
    }
    if (preg_match('/[\\x00-\\x20\\x7F<>"\'`\\\\]/', $url)) {
        return '';
    }
    if (!filter_var($url, FILTER_VALIDATE_URL)) {
        return '';
    }
    $parts = parse_url($url);
    if ($parts === false || empty($parts['scheme']) || empty($parts['host'])) {
        return '';
    }
    return preg_match('/^https?$/i', $parts['scheme']) ? $url : '';
}