CVE-2025-65956CWE-79cross-site-scripting

CVE-2025-65956

Medium · published November 26, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
9.8
In the wild
Unconfirmed
What it is

Formwork is a flat file-based Content Management System (CMS). Prior to version 2.2.0, inserting unsanitized data into the blog tag field results in stored cross‑site scripting (XSS). Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controlled script executed in their browser. The issue is persistent and impacts privileged administrative workflows. This issue has been patched in version 2.2.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00204 · 9.8th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-11-26T05:15Z
Affected products (1)
ProductVersionsFixed in
formwork_project/formwork< 2.2.02.2.0
References (4)
https://github.com/getformwork/formwork/commit/4abcd60ae7692b46d316f956b0b20fb85336f3b2 · [email protected]https://github.com/getformwork/formwork/pull/791 · [email protected]https://github.com/getformwork/formwork/security/advisories/GHSA-7j46-f57w-76pj · [email protected]https://github.com/getformwork/formwork/security/advisories/GHSA-7j46-f57w-76pj · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 25 NOV 23:20Z
    Formwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog Tags
    cvelistv5