CVE-2025-32426: Formie XSS Vulnerability in Email Notification Preview
Summary
CVE-2025-32426: Formie has XSS vulnerability for email notification content for preview. Affects verbb/formie versions < 2.1.44. Fixed in 2.1.44. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Formie is a popular form management plugin for Craft CMS, enabling users to create and manage forms with ease. It offers features such as email notifications, conditional logic, and customizable templates. However, a recently discovered vulnerability allows for cross-site scripting (XSS) attacks through the email notification content preview, posing a risk to users who have access to the form's settings.
Vulnerability Detail
The vulnerability arises from the ability to inject malicious code into the HTML content of an email notification, which is rendered in the preview. This XSS vulnerability does not affect the delivered emails but can be exploited by users with access to the form's email notification settings. Attackers could potentially execute scripts in the context of the user's browser, leading to data theft or other malicious actions.
How To Fix
Minimum fixed version
2.1.44
This is the first release that contains the fix.
composer require verbb/formie:2.1.44Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
The XSS vulnerability in Formie's email notification preview poses a significant risk to users with access to form settings. It is crucial to update to version 2.1.44 or higher to ensure the security of your application. Regular monitoring for vulnerabilities, such as through Vulert, can help maintain the integrity of your software.
See every vulnerability recorded for verbb/formie →
FAQ
The vulnerability is an XSS issue that allows for the injection of malicious scripts into email notification previews.
Users who have access to the email notification settings of forms created with Formie are at risk.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 4.6, indicating a moderate severity level.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the composer.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for verbb/formie.
