CVE-2025-32426 Formie has a XSS vulnerability for email notification content for preview
An attacker with access to email notification settings can inject malicious scripts into the preview, potentially executing code in the admin interface.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-32426?
CVE-2025-32426 is a medium-severity cross-site scripting vulnerability in verbb formie, published on 11 Apr 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means (a delivered email). This would require access to the form's email notification settings. This has been fixed in Formie 2.1.44.
Weakness: CWE-79
Which versions are affected by CVE-2025-32426?
2 open source packages ship an affected version, including verbb/formie. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
verbb/formie Packagist | All versions | 2.1.44 |
verbb/formie Packagist | All versions | 2.1.44 |
Products include Verbb Formie.
How do I fix CVE-2025-32426?
Upgrade verbb/formie to 2.1.44 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-32426 being exploited?
There is no known exploitation of CVE-2025-32426 in the wild and no public exploit code.
Other vulnerabilities in verbb formie
Sources
Also known as GHSA-2xm2-23ff-p8ww.