CVE-2025-32426

Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notification, which is then rendered on the preview. There is no issue when rendering the email via normal means (a delivered email). This would require access to the form's email notification settings. This has been fixed in Formie 2.1.44.

• CWE-79

• https://github.com/verbb/formie/security/advisories/GHSA-2xm2-23ff-p8wwVendor Advisory

Published

Apr 11, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-3242A vulnerability has been found in PHPGurukul e-Diary Managem…9.8
• CVE-2025-32421Next.js is a React framework for building full-stack web app…3.7
• CVE-2025-32422AutoGPT is a workflow automation platform for creating, depl…8.7
• CVE-2025-32423AutoGPT is a workflow automation platform for creating, depl…5.3
• CVE-2025-32424AutoGPT is a workflow automation platform for creating, depl…8.7
• CVE-2025-32425AutoGPT is a platform that allows users to create, deploy, a…5.5
• CVE-2025-32427Formie is a Craft CMS plugin for creating forms. Prior to 2.…5.4
• CVE-2025-32428Jupyter Remote Desktop Proxy allows you to run a Linux Deskt…9
• CVE-2025-32429XWiki Platform is a generic wiki platform offering runtime s…9.8
• CVE-2025-3243A vulnerability was found in code-projects Patient Record Ma…8.8
• CVE-2025-32430XWiki Platform is a generic wiki platform offering runtime s…6.1
• CVE-2025-32431Traefik (pronounced traffic) is an HTTP reverse proxy and lo…9.1