Executive Summary

The vulnerability exists in the Solspace Freeform plugin for Craft CMS 5.x, which is a form-building tool. An authenticated user with low privileges, who can create or edit forms, can inject arbitrary HTML or JavaScript into the Craft Control Panel's builder and integrations views.

This happens because user-controlled form labels and integration metadata are rendered using dangerouslySetInnerHTML without proper sanitization. As a result, stored cross-site scripting (XSS) occurs, which executes when any administrator views the builder or integration screens.

This vulnerability is fixed in version 5.14.7 of the plugin.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a low-privilege authenticated user to inject malicious HTML or JavaScript code into the Craft Control Panel. When an administrator views the affected screens, the malicious code executes.

The impact includes potential unauthorized actions performed in the context of the administrator's session, data theft, session hijacking, or other malicious activities enabled by cross-site scripting.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the Solspace Freeform plugin for Craft CMS to version 5.14.7 or later, where the issue is fixed.

Additionally, restrict low-privilege users from creating or editing forms until the update is applied to prevent exploitation.

Useful 0 Not Useful 0