Stored XSS in Flatpress CMS gallery captions

Successful exploitation allows persistent execution of attacker-supplied JavaScript in the context of the Flatpress CMS application. This can enable session hijacking, unauthorized actions performed with the victim's privileges, theft of sensitive data accessible through the browser, modification of administrative content, and potential compromise of other administrator accounts that view the malicious content. Impact is constrained by the requirement for admin-level access to plant the payload, but can still facilitate privilege abuse, persistence within the admin workflow, and further compromise of the CMS instance.

If immediate upgrade is not possible, restrict access to the administration panel to trusted users only, limit exposure through network access controls, and disable or tightly control use of the gallery captions feature where feasible. Apply strict output encoding for any rendered caption content and consider deploying a Content Security Policy to reduce the likelihood and impact of script execution. Monitor administrative content for injected script tags, event handlers, or other active payloads, and audit admin accounts for misuse.

Upgrade Flatpress CMS to version 1.4 or later. The vulnerable gallery captions handling should be corrected by implementing proper server-side input validation and context-appropriate output encoding when rendering caption content. Review existing stored gallery caption data for malicious script payloads and remove any unauthorized or suspicious entries. After remediation, invalidate active administrator sessions and review administrative actions for signs of abuse.