Fraenkiman

**Name of the Vulnerable Software and Affected Versions** FlatPress versions prior to commit 10be83c **Description** A stored cross-site scripting issue exists in comment and contact forms. The `name`, `URL`, and `email` fields are rendered without proper output encoding in Smarty templates. This allows attackers to inject arbitrary HTML and JavaScript to execute malicious scripts in the browsers of viewers, including administrators, or bypass URL scheme validation to inject `javascript:` or `data:` URIs. **Recommendations** Update to commit 10be83c or a later version.