What is CVE-2025-47280?

CVE-2025-47280 is a medium-severity vulnerability in Umbraco Umbraco_forms, classified under Improper Encoding or Escaping of Output. CVSS score: 6.1/10. Published 2025-05-13.

How severe is CVE-2025-47280?

Medium severity. CVSS v3 base score is 6.1 out of 10.

Vulnerability in Umbraco Umbraco_forms

CVE-2025-47280

Umbraco Forms is a form builder that integrates with the Umbraco content management system. Starting in the 7.x branch and prior to versions 13.4.2 and 15.1.2, the 'Send email' workflow does not HTML encode the user-provided field values i…

EPSS: 0.002 (14.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.

Affected products

Umbraco Umbraco_forms
Umbraco Umbraco.forms.issues — versions >= 7.0.0, < 13.4.2, >= 15.0.0, < 15.1.2

Weakness classification (CWE)

CWE-116 — Improper Encoding or Escaping of Output

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2025-47280?: CVE-2025-47280 is a medium-severity vulnerability in Umbraco Umbraco_forms, classified under Improper Encoding or Escaping of Output. CVSS score: 6.1/10. Published 2025-05-13.
How severe is CVE-2025-47280?: Medium severity. CVSS v3 base score is 6.1 out of 10.