CVE-2025-29602 - Stored cross site scripting(XSS) vulnerabilities in the FlatPress CMS 1.3.1

Description

A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS 1.3.1. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently.

When a regular user visits the compromised page (e.g., a blog post), the injected payload executes automatically in the victim's browser.

Affected product

• Flatpress
• Version : 1.3.1
• Component : Edit category

⚠️ Impact

• Steal session cookies.
• Phishing Attacks
• Remote Code Execution (via JavaScript)
• Redirect users to malicious sites.

POC

 :9

Code area

Flatpress github

Fixed Version

FlatPress 1.4 "Notturno" link

CVE Assignment

• CVE ID: CVE-2025-29602