CVE-2025-32427: Formie has a XSS vulnerability for importing forms

Published Apr 11, 2025
·
Updated

Impact When importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported.

As imports are undertaking primarily by users who have themselves exported the form from one environment to another, and would require direct manipulation of the JSON export, this is marked as moderate. This vulnerability will not occur unless someone deliberately tampers with the export.

Patches This has been fixed in Formie 2.1.44. Users should ensure they are running at least this version.

Other sources

Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, the output wasn't correctly escaped when viewing a preview of what was to be imported. As imports are undertaking primarily by users who have themselves exported the form from one environment to another, and would require direct manipulation of the JSON export, this is marked as moderate. This vulnerability will not occur unless someone deliberately tampers with the export. This vulnerability is fixed in 2.1.44.

— MITRE

Affected Software

3 affected componentsFixes available
Formie Craft CMS plugin<2.1.44
composer/verbb/formie<=2.1.43
2.1.44
verbb Formie Craft Cms<2.1.44

Event History

Apr 11, 2025
CVE Published
via MITRE·01:42 PM
Data Sourced
via MITRE·01:42 PM
DescriptionWeakness
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:15 PM
Affected Software
Advisory Published
via GitHub·07:58 PM

Frequently Asked Questions

1

What is the severity of CVE-2025-32427?

CVE-2025-32427 has a medium severity rating due to potential cross-site scripting vulnerabilities during form import.

2

How do I fix CVE-2025-32427?

To fix CVE-2025-32427, update the Formie plugin to version 2.1.44 or later.

3

What versions of Formie are affected by CVE-2025-32427?

Formie versions prior to 2.1.44 are affected by CVE-2025-32427.

4

What kind of vulnerability is CVE-2025-32427?

CVE-2025-32427 is a cross-site scripting (XSS) vulnerability associated with improper output escaping during form imports.

5

What impact could CVE-2025-32427 have on my website?

If exploited, CVE-2025-32427 could allow attackers to inject malicious scripts into the form previews, potentially affecting website users.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203