CVE-2025-47280 Umbraco.Forms has HTML injection vulnerability in 'Send email' workflow
Attackers can inject HTML into emails sent by Umbraco Forms, potentially bypassing spam filters and email client security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-47280?
CVE-2025-47280 is a low-severity cross-site scripting vulnerability in Umbraco.Forms.Issues, published on 13 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Umbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 and 15.1.2, the 'Send email' workflow does not HTML encode the user-provided field values in the sent email message, making any form with this workflow configured vulnerable, as it allows sending the message from a trusted system and address, potentially bypassing spam and email client security systems. This issue affects all (supported) versions Umbraco Forms and is patched in 13.4.2 and 15.1.2. Unpatched or unsupported versions can workaround this issue by using the `Send email with template (Razor)` workflow instead or writing a custom workflow type. To avoid accidentally using the vulnerable workflow again, the `SendEmail` workflow type can be removed using a composer available in the GitHub Security Advisory for this vulnerability.
Weakness: CWE-116
Which versions are affected by CVE-2025-47280?
6 open source packages ship an affected version, including Umbraco.Forms and UmbracoForms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Umbraco.Forms NuGet | From 14.0.0 | 15.1.2 |
Umbraco.Forms NuGet | From 14.0.0 | 15.1.2 |
Umbraco.Forms NuGet | From 7.0.0 | 13.4.2 |
Umbraco.Forms NuGet | From 7.0.0 | 13.4.2 |
UmbracoForms NuGet | From 7.0.0 to 8.13.16 | None |
UmbracoForms NuGet | From 7.0.0 to 8.13.16 | None |
Products include Umbraco Umbraco Forms.
How do I fix CVE-2025-47280?
Upgrade Umbraco.Forms to a fixed version for your release line: 15.1.2 or 13.4.2.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-47280 being exploited?
There is no known exploitation of CVE-2025-47280 in the wild and no public exploit code.
Other vulnerabilities in Umbraco.Forms.Issues
- CVE-2021-33224 File upload in n/a
- CVE-2025-68924 UmbracoForms Vulnerable to Remote Code Execution via Untrusted WSDL Compilation in Dynamic SOAP Client Generation
- CVE-2026-24687 Umbraco.Forms has path traversal and file enumeration vulnerability in Linux/Mac
- CVE-2025-23041 Short and Long Answer Fields Are Not Validated Server-Side For Maximum Length in Umbraco.Forms
- CVE-2020-7685 Insecure Defaults
Sources
Also known as GHSA-2qrj-g9hq-chph.