CVE-2024-58291 MEDIUM

CVE-2024-58291: Flatboard 3.2 Authenticated Stored Cross-Site Scripting via Forum Information Field

Vendor Flatboard

Product Flatboard

Weakness CWE-79 · XSS

Published December 11, 2025

Last update December 18, 2025

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

Flatboard 3.2 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts in forum information fields. Attackers can insert JavaScript payloads that execute when other users view the forum, potentially stealing session cookies and executing client-side scripts.

Key dates

02Disclosure timeline

December 11, 2025 CVE published

December 18, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-58291 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-23600 WordPress Send to a Friend Addon plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-33633 WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2023-5114 idbbee <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2023-47814 WordPress BMI Calculator Plugin Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS) CVE-2025-67978 WordPress Educare plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability