CVE-2026-76089 | High | 7.7 | 2026-09-23 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action i… |
CVE-2026-76087 | High | 8.2 | 2026-09-23 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::acti… |
CVE-2026-76086 | High | 8.5 | 2026-09-23 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsCon… |
CVE-2026-52889 | Critical | 9.8 | 2026-08-19 | Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, C… |
CVE-2026-47266 | | | 2026-05-29 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or gues… |
CVE-2026-45697 | Critical | 9.8 | 2026-05-29 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default… |
CVE-2025-32427 | Medium | 5.4 | 2025-04-11 | Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, th… |
CVE-2025-32426 | Medium | 4.6 | 2025-04-11 | Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notificatio… |
CVE-2024-35191 | Medium | 4.4 | 2024-05-20 | Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that suppor… |
CVE-2020-13870 | Medium | 5.4 | 2020-06-05 | An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name. |
CVE-2020-13869 | Medium | 5.4 | 2020-06-05 | An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name. |
CVE-2020-13868 | Medium | 6.5 | 2020-06-05 | An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity. |
CVE-2020-13486 | Medium | 6.1 | 2020-05-25 | The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection. |
CVE-2020-13485 | Critical | 9.1 | 2020-05-25 | The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header. |
CVE-2020-13459 | Medium | 5.4 | 2020-05-25 | An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action. |
CVE-2020-13458 | High | 8.8 | 2020-05-25 | An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action. |