CVE-2026-82451: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in getformwork Formwork

CVE-2026-82451 is a stored cross-site scripting vulnerability affecting Formwork versions from 2.0.0 up to and including 2.3.10. The vulnerability occurs in the visit tracking functionality, which logs the Referer header host without neutralizing potentially malicious input. An unauthenticated attacker can craft a malicious Referer header to inject executable markup that triggers when an administrator accesses the Statistics panel. This can lead to script execution in the context of the administrator's browser session.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in administrator browsers when viewing the Statistics panel. This could lead to session hijacking, unauthorized actions, or other impacts typical of stored XSS vulnerabilities. The CVSS 4.0 base score is 5.3, indicating a medium severity impact with network attack vector, low complexity, no privileges required, and user interaction needed.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, administrators should exercise caution when accessing the Statistics panel and consider restricting access or sanitizing Referer headers at the network level if possible.