Vulnerability Intelligence Report
Formwork < 2.3.11 Stored XSS via Referer Header
CVE-2026-82451
Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel.
Cross-Site Scripting (XSS)
No Active Exploit Signals
CVSS Base Score
5.3
MEDIUM
EPSS Probability:0.36%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-79 ↗Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| getformwork | Formwork | 2.0.0 <= 2.3.10 (affected), 2.3.11 (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulnCheck · Bug Bounty Provider · USA |
| Reserved | 2026-08-29T13:22:58 |
| Published | 2026-08-29T13:47:54 |
| Patch Date | 2026-08-26 |
| Last Updated | 2026-09-24T14:20:26 |
Community Chatter & Buzz