EUVD-2026-68106
GHSA-3p45-hx6j-c7f5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector, no privileges, low complexity; scope changes because payload executes in admin browser context; UI:R required since admin must view Statistics panel.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel.
AnalysisAI
Stored XSS in Formwork through 2.3.14 allows unauthenticated remote attackers to inject persistent malicious markup into the Statistics panel by crafting HTTP requests with malicious Referer headers. The visit-tracking subsystem records the Referer host value without HTML escaping, storing attacker-controlled content in the statistics data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two conditions: first, that the target site runs Formwork through 2.3.14 with visit tracking enabled (the feature must be active and accumulating Referer data); second, that an administrator navigates to the Statistics panel after the malicious request is stored. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) correctly captures that exploitation is trivially automatable - an attacker needs only to send a single crafted HTTP request to any page of the target site with no authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade Formwork beyond version 2.3.14; the exact patched release version is not independently confirmed from the available reference data - the upstream fix is traceable to GitHub commit 89d1908572e55809d6ee1771f59a816494c29573, but a tagged release version should be verified via the official advisory at https://github.com/getformwork/formwork/security/advisories/GHSA-hpgc-57cm-66pc before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Formwork is a flat file-based Content Management System (CMS). Rated medium severity (CVSS 6.5), this vulnerability is r
Formwork CMS versions 2.0.0 through 2.3.3 fail to validate user privileges during account creation, allowing authenticat
Formwork is a flat file-based Content Management System (CMS). Rated medium severity (CVSS 4.8), this vulnerability is r
A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today