Vulnerability · Published Nov 25, 2025 · Assigned by GitHub_M
CVE-2025-65956Formwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog Tags
Medium 6.5
In plain English
A medium-severity cross-site scripting in formwork from getformwork. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Formwork is a flat file-based Content Management System (CMS). Prior to version 2.2.0, inserting unsanitized data into the blog tag field results in stored cross‑site scripting (XSS). Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controlled script executed in their browser. The issue is persistent and impacts privileged administrative workflows. This issue has been patched in version 2.2.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | getformwork/formwork | 2.2.0 | GHSA-7j46-f57w-76pj |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| getformwork | formwork | < 2.2.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
References
- https://github.com/getformwork/formwork/security/advisories/GHSA-7j46-f57w-76pj x_refsource_CONFIRM
- https://github.com/getformwork/formwork/pull/791 x_refsource_MISC
- https://github.com/getformwork/formwork/commit/4abcd60ae7692b46d316f956b0b20fb85336f3b2 x_refsource_MISC