Stored Cross-Site Scripting Vulnerability in Formwork by Getformwork

CVE-2026-82451

What is CVE-2026-82451?

A stored cross-site scripting vulnerability exists in Formwork through version 2.3.14, specifically in the visit tracking feature. This weakness allows unauthenticated attackers to manipulate the Referer header. By injecting malicious markup, attackers can execute arbitrary scripts in the browsers of administrators accessing the Statistics panel. The unescaped nature of the Referer header becomes a conduit for these malicious scripts, thus compromising the integrity of the application and potentially allowing further exploit attempts when admins review data.

References