CVE-2026-82451: Formwork through 2.3.14 Stored XSS via Referer Header

Q: Who is exposed to this issue?

Formwork installations running versions through 2.3.14 are exposed if their visit-tracking data can record attacker-controlled Referer headers and an administrator views the Statistics panel.

Q: What does an attacker need to exploit it?

The attacker does not need authentication. They need to cause Formwork to record a crafted Referer header containing malicious markup, then rely on an administrator opening the Statistics panel where the stored value is rendered.

Q: What is the impact when exploitation succeeds?

Malicious markup executes in the administrator's browser in the context of the Formwork panel. The provided severity vector indicates low confidentiality and integrity impact, with no availability impact.

Q: How can administrators determine whether they may already be affected?

Review visit-tracking records and the Statistics panel for unexpected or markup-like Referer host values. The vulnerable behavior is the storage and unescaped display of the Referer header host.

Published Aug 29, 2026

Updated

Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel.

Affected Software

1 affected component

Formwork Formwork<=2.3.14

Event History

Aug 29, 2026

CVE Published

via MITRE·01:47 PM

Data Sourced

via MITRE·01:47 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Formwork installations running versions through 2.3.14 are exposed if their visit-tracking data can record attacker-controlled Referer headers and an administrator views the Statistics panel.

What does an attacker need to exploit it?

The attacker does not need authentication. They need to cause Formwork to record a crafted Referer header containing malicious markup, then rely on an administrator opening the Statistics panel where the stored value is rendered.

What is the impact when exploitation succeeds?

Malicious markup executes in the administrator's browser in the context of the Formwork panel. The provided severity vector indicates low confidentiality and integrity impact, with no availability impact.

How can administrators determine whether they may already be affected?

Review visit-tracking records and the Statistics panel for unexpected or markup-like Referer host values. The vulnerable behavior is the storage and unescaped display of the Referer header host.

CVE-2026-82451: Formwork through 2.3.14 Stored XSS via Referer Header

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact when exploitation succeeds?

How can administrators determine whether they may already be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact when exploitation succeeds?

How can administrators determine whether they may already be affected?