Formie Craft CMS Plugin Cross-Site Scripting Vulnerability in JSON Import

A cross-site scripting vulnerability has been identified in the Formie Craft CMS plugin, affecting versions through 2.1.43. The issue arises when importing forms from JSON; if the field label or handle includes malicious content, it is not properly escaped in the preview of the import. This vulnerability requires deliberate tampering with the JSON export and is primarily a concern for users transferring forms between environments.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker could inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can upgrade to Formie version 2.1.44 or later to address this vulnerability.