CVE-2025-32426mediumCWE-79

CVE-2025-32426: medium-severity vulnerability in verbb formie

Formie has a XSS vulnerability for email notification content for preview

Published

Follow this CVE+ Monitor formie+ Monitor verbb/formie

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.6epss 0.2%
Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means (a delivered email). This would require access to the form's email notification settings. This has been fixed in Formie 2.1.44.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected products
verbb · formie
Related CVEs — verbb formie

In the same product, most dangerous first.

CVE-2026-52889CRITICALFormie: Server-Side Template Injection in Formie Hidden field defaultsEPSS 1.3%CVE-2026-76086HIGHFormie: Integration form-settings action allows SSRF and exfiltration of stored integration credentialsEPSS 0.5%CVE-2026-45697CRITICALFormie: Pre-authenticated server-side template injection in Hidden fieldsEPSS 0.5%CVE-2026-76089HIGHFormie: Missing authorization on sent notification resend modal exposes submission PIIEPSS 0.4%CVE-2026-76087HIGHFormie: Unauthenticated users can overwrite incomplete submissions via submit actionEPSS 0.4%CVE-2026-47266HIGHFormie: Unauthenticated front-end submission editing can overwrite existing submissionsEPSS 0.3%