CVE-2026-26188
Stored XSS in Solspace Freeform Plugin Allows Admin Panel Injection
Publication date: 2026-02-12
Last updated on: 2026-02-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| solspace | freeform | From 5.0.0 (inc) to 5.14.7 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in the Solspace Freeform plugin for Craft CMS 5.x, which is a form-building tool. An authenticated user with low privileges, who can create or edit forms, can inject arbitrary HTML or JavaScript into the Craft Control Panel's builder and integrations views.
This happens because user-controlled form labels and integration metadata are rendered using dangerouslySetInnerHTML without proper sanitization. As a result, stored cross-site scripting (XSS) occurs, which executes when any administrator views the builder or integration screens.
This vulnerability is fixed in version 5.14.7 of the plugin.
How can this vulnerability impact me? :
This vulnerability allows a low-privilege authenticated user to inject malicious HTML or JavaScript code into the Craft Control Panel. When an administrator views the affected screens, the malicious code executes.
The impact includes potential unauthorized actions performed in the context of the administrator's session, data theft, session hijacking, or other malicious activities enabled by cross-site scripting.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade the Solspace Freeform plugin for Craft CMS to version 5.14.7 or later, where the issue is fixed.
Additionally, restrict low-privilege users from creating or editing forms until the update is applied to prevent exploitation.