Is CVE-2026-82451 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-82451?

CVE-2026-82451 has a CVSS v3 severity of MEDIUM (6.1).

Back

CVE-2026-82451

Description

Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel.