CVE-2026-82451 — Formwork < 2.3.11 Stored XSS via Referer Header
Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft…
Published: 2026-08-29 · CVSS: 5.3 · CVSS 4.0
Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7