CVE-2025-32427: Formie has a XSS vulnerability for importing forms
Impact When importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported.
As imports are undertaking primarily by users who have themselves exported the form from one environment to another, and would require direct manipulation of the JSON export, this is marked as moderate. This vulnerability will not occur unless someone deliberately tampers with the export.
Patches This has been fixed in Formie 2.1.44. Users should ensure they are running at least this version.
Other sources
Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who have themselves exported the form from one environment to another, and would require direct manipulation of the JSON export, this is marked as moderate. This vulnerability will not occur unless someone deliberately tampers with the export. This vulnerability is fixed in 2.1.44.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32427?
CVE-2025-32427 has a medium severity rating due to potential cross-site scripting vulnerabilities during form import.
How do I fix CVE-2025-32427?
To fix CVE-2025-32427, update the Formie plugin to version 2.1.44 or later.
What versions of Formie are affected by CVE-2025-32427?
Formie versions prior to 2.1.44 are affected by CVE-2025-32427.
What kind of vulnerability is CVE-2025-32427?
CVE-2025-32427 is a cross-site scripting (XSS) vulnerability associated with improper output escaping during form imports.
What impact could CVE-2025-32427 have on my website?
If exploited, CVE-2025-32427 could allow attackers to inject malicious scripts into the form previews, potentially affecting website users.