Medium severity · published Nov 25, 2025
CVE-2025-65956
Formwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog Tags
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
Formwork is a flat file-based Content Management System (CMS). Prior to version 2.2.0, inserting unsanitized data into the blog tag field results in stored cross‑site scripting (XSS). Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controlled script executed in their browser. The issue is persistent and impacts privileged administrative workflows. This issue has been patched in version 2.2.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 12% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
formwork · getformwork
< 2.2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-65956
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-65956
Patch
https://github.com/getformwork/formwork/commit/4abcd60ae7692b46d316f956b0b20fb85336f3b2
Issue Tracking
https://github.com/getformwork/formwork/pull/791
Exploit
https://github.com/getformwork/formwork/security/advisories/GHSA-7j46-f57w-76pj
More from formwork
8.8
CVE-2026-27198
Formwork Improperly Manages Privileges During User Creation
7.1
CVE-2026-104478
Formwork before 2.3.13 Path Traversal via BackupController Download and Delete
6.1
CVE-2026-82451
Formwork < 2.3.11 Stored XSS via Referer Header
3.5
CVE-2026-105950
getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting