CVE-2025-29602

MEDIUM

flatpress < 1.3.1 - Cross-Site Scripting in Administration Area via Manage Categories

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-29602. PoCs published by harish0x.

AI-analyzed exploit summary This repository documents a stored XSS vulnerability in FlatPress CMS 1.3.1, where an admin can inject malicious JavaScript via the 'Edit category' component. The payload executes when users visit compromised pages.

Description

flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.

Exploits (1)

nomisec WRITEUP
by harish0x · poc
https://github.com/harish0x/CVE-2025-29602

This repository documents a stored XSS vulnerability in FlatPress CMS 1.3.1, where an admin can inject malicious JavaScript via the 'Edit category' component. The payload executes when users visit compromised pages.

Classification
Writeup 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: FlatPress CMS 1.3.1
Auth required
Prerequisites: Admin access to FlatPress CMS
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 6.1
EPSS 0.0024
EPSS Percentile 15.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
flatpress/flatpress < 1.3.1
Published May 07, 2025
Tracked Since Feb 18, 2026