Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-82451

Formwork < 2.3.11 Stored XSS via Referer Header

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

getformwork Formwork

Default version status: unaffected

  • 2.0.0 to ≤ 2.3.10affected
  • 2.3.11unaffected
pkg:github/getformwork/formwork

References