Medium severity · published Aug 29, 2026
CVE-2026-82451
Formwork < 2.3.11 Stored XSS via Referer Header
6.1
CVSS
0.4%
EPSS
No
On KEV
Description
Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Formwork · getformwork
2.0.0 through 2.3.10 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82451
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82451
github.com
https://github.com/getformwork/formwork/releases/tag/2.3.11
github.com
https://github.com/getformwork/formwork/security/advisories/GHSA-hpgc-57cm-66pc
www.vulncheck.com
https://www.vulncheck.com/advisories/formwork-stored-xss-via-referer-header
More from Formwork
8.8
CVE-2026-27198
Formwork Improperly Manages Privileges During User Creation
7.1
CVE-2026-104478
Formwork before 2.3.13 Path Traversal via BackupController Download and Delete
5.4
CVE-2025-65956
Formwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog Tags
3.5
CVE-2026-105950
getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting