Formie Craft CMS Plugin Cross-Site Scripting Vulnerability in Email Notifications

A cross-site scripting vulnerability has been identified in the Formie plugin for Craft CMS, affecting versions through 2.1.43. The issue allows for the injection of malicious code into the HTML content of email notifications, which is then rendered in the preview. This vulnerability requires access to the form's email notification settings. However, the issue does not occur when the email is delivered normally.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected malicious code is executed in the context of the user viewing the email preview.

Remediation

Users can upgrade to Formie version 2.1.44 or later to address this vulnerability.