TI-2025-40524 Aliases CVE-2025-65956 GHSA-7j46-f57w-76pj

Formwork CMS Has a Stored Cross-Site Scripting (XSS) Vulnerability in Blog Tags

MEDIUM 62CWE-79Published 2025-11-25 · Updated 2025-11-26

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Formwork is a flat file-based Content Management System (CMS). Prior to version 2.2.0, inserting unsanitized data into the blog tag field results in stored cross‑site scripting (XSS). Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controlled script executed in their browser. The issue is persistent and impacts privileged administrative workflows. This issue has been patched in version 2.2.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00218 12th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed formwork (getformwork): 2.2.0getformwork/formwork (Packagist): 2.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
getformwork	formwork	before 2.2.0	2.2.0	Patch available	CNA
—	getformwork/formwork (Packagist)	before 2.2.0	2.2.0	Patch available	GHSA-7j46-f57w-76pj

formwork Vendorgetformwork Affected before 2.2.0 Fixed in 2.2.0 Patch available CNA
getformwork/formwork (Packagist) Vendor— Affected before 2.2.0 Fixed in 2.2.0 Patch available GHSA-7j46-f57w-76pj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:formwork_project:formwork::::::::	before 2.2.0	Vulnerable	getformwork

cpe:2.3:a:formwork_project:formwork:*:*:*:*:*:*:*:* Versions before 2.2.0 Vulnerable ·getformwork

Remediation

Fix · CNA formwork (getformwork) Fixed in 2.2.0
Fix · GHSA-7j46-f57w-76pj getformwork/formwork (Packagist) Fixed in 2.2.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-65956
2026-10-03 Alias added: GHSA-7j46-f57w-76pj

References

Exploit 1

https://github.com/getformwork/formwork/security/advisories/GHSA-7j46-f57w-76pj

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-65956

Other 1

https://github.com/getformwork/formwork

TI-2023-09940 A stored cross-site scripting (XSS) vulnerability in the component… CVSS 3.1MEDIUM 4.8
TI-2026-21635 Formwork Improperly Manages Privileges During User Creation CVSS 3.1HIGH 8.8
TI-2024-24687 Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences