Flatpm Wp Vulnerabilities

The FlatPM – Ad Manager, AdSense and Custom Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rank_math_description' custom field in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVSS:

6.4

Affected:

up to 3.2.2

Fixed in:

3.2.3

Disclosed:

Jan 20, 2026

CVE-2026-0690 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mehanoid.Pro FlatPM allows Stored XSS.This issue affects FlatPM: from n/a before 3.1.05.

Affected:

up to 3.1.05

Fixed in:

3.1.05

Disclosed:

Mar 27, 2024

CVE-2024-29803 on NVD →

The FlatPM plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to 3.1.05 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenev...

CVSS:

6.4

Affected:

up to 3.1.05

Fixed in:

3.1.05

Disclosed:

Mar 25, 2024

CVE-2024-29803 on NVD →

[en] The FlatPM WordPress plugin before 3.0.13 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Affected:

up to 2.662

Fixed in:

2.662

Disclosed:

Dec 12, 2022

CVE-2022-3934 on NVD →

The Flat PM plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 2.661 due to insufficient input sanitization and output escaping on the block_cat_ID value. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if the...

CVSS:

6.1

Affected:

up to 2.661

Fixed in:

2.662

Disclosed:

Nov 17, 2022

CVE-2022-3934 on NVD →