Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the file upload functionality of Flatpress prior to version 1.3 [1]. The application did not properly validate or restrict file types, allowing users to upload SVG files containing malicious JavaScript code. When an admin or other user views the uploaded file, the embedded script executes in their browser session [2].

Exploitation

An attacker with upload access to the Flatpress instance (e.g., a registered author or through a compromised account) can craft an SVG file containing a `` tag or event handler. The attacker uploads this file via the normal media upload mechanism. No additional user interaction is required beyond viewing the uploaded file—for example, when an administrator previews the media library or the uploaded file appears inline in a blog post [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, defacement, theft of credentials, or other actions limited only by the victim's browser permissions and the application's security boundaries. The stored nature of the payload means every subsequent viewer until cleanup is potentially affected [2].

Mitigation

The vulnerability is fixed in Flatpress version 1.3 by adding SVG to the list of forbidden file types [1]. Users should upgrade to 1.3 or later immediately. If upgrading is not possible, administrators can manually block SVG file extensions in the upload configuration or disable upload functionality entirely as a temporary workaround until the patch can be applied [2].