CVE-2026-82451

Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel...

CVE-2026-82451 Formwork < 2.3.11 Stored XSS via Referer Header

Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel...

CVE-2026-82451 Formwork < 2.3.11 Stored XSS via Referer Header

Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel...

CVE-2026-82451

Formwork (through version 2.3.14) contains a stored cross-site scripting (XSS) vulnerability in its visit tracking functionality. The root cause is that the Referer header host is recorded unescaped in the statistics data. An unauthenticated attacker can craft a malicious Referer header, which is...

EUVD-2026-68106

Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel...

CVE-2026-82451

Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel...

CVE-2026-82451 Formwork < 2.3.11 Stored XSS via Referer Header

Formwork before 2.3.11 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel...

PT-2026-83430

Name of the Vulnerable Software and Affected Versions Formwork versions prior to 2.3.15 Description A stored cross-site scripting issue exists in the visit tracking feature. The system records the host from the Referer header without proper escaping. This allows unauthenticated attackers to injec...

CVE-2026-64713

This issue was addressed with improved checks. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. Websites may know if the user has visited a given link...