CVE-2025-32427 Formie has a XSS vulnerability for importing forms
An attacker can execute arbitrary scripts in the admin interface by tampering with JSON form imports in Formie.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-32427?
CVE-2025-32427 is a medium-severity cross-site scripting vulnerability in verbb formie, published on 11 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who have themselves exported the form from one environment to another, and would require direct manipulation of the JSON export, this is marked as moderate. This vulnerability will not occur unless someone deliberately tampers with the export. This vulnerability is fixed in 2.1.44.
Weakness: CWE-79
Which versions are affected by CVE-2025-32427?
2 open source packages ship an affected version, including verbb/formie. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
verbb/formie Packagist | All versions | 2.1.44 |
verbb/formie Packagist | All versions | 2.1.44 |
Products include Verbb Formie.
How do I fix CVE-2025-32427?
Upgrade verbb/formie to 2.1.44 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-32427 being exploited?
There is no known exploitation of CVE-2025-32427 in the wild and no public exploit code.
Other vulnerabilities in verbb formie
Sources
Also known as GHSA-p9hh-mh5x-wvx3.