CVE-2025-25460

Published: Feb 24, 2025Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts, which are executed when other users view the posts. The issue arises due to improper input sanitization of the "TextArea" field in the blog entry submission form.

Affected (1)

Products: Flatpress: Flatpress

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Flatpress Flatpress	Version 1.3.1

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://github.com/RoNiXxCybSeC0101/CVE-2025-25460

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/flatpressblog/flatpress

Source: cve@mitre.org

Product

https://github.com/RoNiXxCybSeC0101/CVE-2025-25460

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.