CVE-2020-11056: Barrelstrengthdesign Sprout Forms

Medium severity, CVSS 6.3. EPSS: 1% chance of exploitation in the next 30 days.

In Sprout Forms before 3.9.0, there is a potential Server-Side Template Injection vulnerability when using custom fields in Notification Emails which could lead to the execution of Twig code. This has been fixed in 3.9.0.

Affected products

• Barrelstrengthdesign Sprout Forms: before 3.9.0 (fixed in 3.9.0)

Published 2020-05-07. Last modified 2026-06-17.