Security Advisory

CVE-2025-32426

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-04-11 13:42:21

Last updated 2025-04-11 14:16:53

Assigner GitHub_M

State PUBLISHED

Description

Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means (a delivered email). This would require access to the forms email notification settings. This has been fixed in Formie 2.1.44.

← Browse all CVEs View on cve.org ↗