verbb/formie vulnerabilities
CVEs whose affected-version data names the verbb/formie package (composer). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-52889Critical· 9.8Formie is a Craft CMS plugin for creating forms
Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Valu…
▾ Midnightverbb · verbb/formieEPSS 0.68%via NVD
GHSA-cvpc-hccg-wmw4Medium· 6.3Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration
Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration
▾ Sunlitverbb · verbb/formievia GHSA