CVE-2020-35240: Your example is not reproducible

[MioVisman]

Your example is not reproducible:

payload in "Blog Content"

FluxBB doesn't have "Blog Content"

Now go to the URL: https://127.0.0.1/fluxbb/post.php?action=post&fid=1
Put the payload in Content:

post.php on its form does not contain Content field

and the attacker can able to steal the cookie according to the crafted payload.

In FluxBB, user cookies are not accessible from javascript. The httponly flag is enabled by default.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies#restrict_access_to_cookies

Or are you talking about admin functions (files admin_*.php)?

P.S. MioVisman/FluxBB_by_Visman#13

[MioVisman]

A month has passed, but there is no confirmation of this vulnerability.