Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress

Vulnerability

A stored Cross-site Scripting (XSS) vulnerability exists in the Media Manager plugin of flatpressblog/flatpress prior to version 1.3 [1]. The bug allows an attacker to inject arbitrary JavaScript code by crafting malicious image metadata (such as the image title or description) that is not properly sanitized before being stored and later rendered in the Media Manager interface [2]. All versions before 1.3 are affected.

Exploitation

An attacker needs to have the ability to upload images or modify image metadata in the Media Manager, which typically requires authenticated access with upload privileges [1]. The attacker uploads an image containing specially crafted metadata with embedded JavaScript payload. When any user (including administrators) views the Media Manager, the malicious script executes in their browser context [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The compromise occurs at the victim's privilege level; if an administrator views the page, the attacker gains full administrative access [2].

Mitigation

The vulnerability is fixed in flatpress version 1.3 [1]. The fix properly sanitizes image metadata before rendering in the Media Manager [1]. Users should upgrade to version 1.3 or later. No workaround is available for earlier versions. As of the publication date, this vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.