CVE-2025-25460

Summary

CVE-2025-25460 is a stored Cross-Site Scripting (XSS) vulnerability affecting FlatPress 1.3.1. This issue lies in the "Add Entry" feature, where the "TextArea" field in the blog entry submission form fails to properly sanitize user input. Authenticated attackers can exploit this weakness by injecting malicious JavaScript payloads into blog posts. When other users view these compromised posts, the malicious scripts are executed, posing a significant security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.