Composer getformwork/formwork has 7 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2023-24230 | Formwork Cross-site Scripting (XSS) from Page title field | medium | 4.8 | <1.13.0 | 1.13.0 |
| CVE-2024-37160 | Cross-site scripting (XSS) vulnerability in Description metadata | medium | 4.8 | <1.13.1 or >=2.0.0-beta.1 and <2.0.0-beta.2 | 1.13.1, 2.0.0-beta.2 |
| CVE-2026-27198 | Formwork Improperly Managed Privileges in User creation | high | 8.8 | >=2.0.0 and <2.3.4 | 2.3.4 |
| CVE-2024-35621 | formwork Cross-site scripting vulnerability in Markdown fields | medium | 4.8 | <1.13.0 | 1.13.0 |
| CVE-2025-65956 | Formwork CMS has Stored Cross-Site Scripting Vulnerebility in Blog Tags | medium | 6.5 | <2.2.0 | 2.2.0 |
| GHSA-c85w-x26q-ch87 | Formwork improperly validates input of User role preventing site and panel availability | high | 8.2 | >=2.0.0-beta.1 and <2.0.0-beta.4 | 2.0.0-beta.4 |
| GHSA-vf6x-59hh-332f | Formwork has a cross-site scripting (XSS) vulnerability in Site title | medium | 4.7 | >=2.0.0-beta.3 and <2.0.0-beta.4 | 2.0.0-beta.4 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked