Formwork Cross-site Scripting (XSS) from Page title field

MEDIUM 4.8CVE-2023-24230 · GHSA-fvrh-wrpf-6q7h · Published 10/02/2023 · updated 17/06/2026

In short

CVE-2023-24230 is a MEDIUM (CVSS 4.8) vulnerability affecting getformwork/formwork, formwork (formwork project).
Chance of exploitation in the next 30 days (EPSS): 0.54%, higher than 45.8% of all vulnerabilities.
Fix: update to 1.13.0 or later.

Package	Affected versions	Patched versions
getformwork/formwork Packagist	`< 1.13.0`	`1.13.0`
formwork formwork_project	`= 1.12.1`	No fix yet

Description

A stored cross-site scripting (XSS) vulnerability in Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title field.

Only users with access to Administration Panel with page editing permission can inject raw HTML in the Page title field.

Patched versions

This vulnerability has been patched in Formwork 1.13.0.

NVD description

A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter.

References

More vulnerabilities in getformwork/formwork

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

getformwork/formwork

Packagist

< 1.13.0

1.13.0

formwork

formwork_project

= 1.12.1

No fix yet

Description

A stored cross-site scripting (XSS) vulnerability in Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title field.

Only users with access to Administration Panel with page editing permission can inject raw HTML in the Page title field.

Patched versions

This vulnerability has been patched in Formwork 1.13.0.

NVD description

More vulnerabilities in getformwork/formwork

See all →