CVE-2025-65956
Medium · 6.5Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags
CVSS
6.5
EPSS
0.2%
Published
Nov 24, 2025
CISA due date
—
The record
Inserting unsanitized data into the blog tag field in Formwork CMS results in stored cross‑site scripting (XSS). Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controlled script executed in their browser. Because the issue is persistent and impacts privileged administrative workflows, the severity is elevated.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | getformwork/formwork | 0 | 2.2.0 |
Related vulnerabilities
- GHSA-7j46-f57w-76pj Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags Same vulnerability
- CVE-2026-27198 Formwork is a flat file-based Content Management System (CMS). Also affects getformwork/formwork
- GHSA-34p4-7w83-35g2 Formwork Improperly Managed Privileges in User creation Also affects getformwork/formwork
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96382 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96368 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96361 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79
- CVE-2026-96362 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79