getformwork CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM getformwork CVE published 2026-08-29

CVE-2026-82451

CVE-2026-82451 is a stored cross-site scripting vulnerability in Formwork before 2.3.11. The vulnerability records the Referer header host unescaped in visit tracking, allowing unauthenticated attackers to craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel. This vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severit [truncated]