Medium severity · published Apr 11, 2025
CVE-2025-32426
Formie has a XSS vulnerability for email notification content for preview
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means (a delivered email). This would require access to the form's email notification settings. This has been fixed in Formie 2.1.44.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
formie · verbb
< 2.1.44 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-32426
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-32426
Vendor Advisory
https://github.com/verbb/formie/security/advisories/GHSA-2xm2-23ff-p8ww
More from formie
9.8
CVE-2026-52889
Formie: Server-Side Template Injection in Formie Hidden field defaults
9.8
CVE-2026-45697
Formie: Pre-authenticated server-side template injection in Hidden fields
8.7
CVE-2026-47266
Formie: Unauthenticated front-end submission editing can overwrite existing submissions
8.5
CVE-2026-76086
Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials
8.2
CVE-2026-76087
Formie: Unauthenticated users can overwrite incomplete submissions via submit action