CVE-2026-26188: Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue
(updated )
Summary
An authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to stored XSS that executes when any admin views the builder/integration screens.
Affected Product
- Ecosystem: Packagist (Craft CMS plugin)
- Package: solspace/craft-freeform
- Version: <= 5.14.6 (latest observed). Likely all 5.x until patched.
References
- github.com/advisories/GHSA-jp3q-wwp3-pwv9
- github.com/solspace/craft-freeform
- github.com/solspace/craft-freeform/commit/b9adad6cdf1eba5400aae8b1ae39bd7d4d33af5e
- github.com/solspace/craft-freeform/releases/tag/v5.14.7
- github.com/solspace/craft-freeform/security/advisories/GHSA-jp3q-wwp3-pwv9
- nvd.nist.gov/vuln/detail/CVE-2026-26188
Code Behaviors & Features
Detect and mitigate CVE-2026-26188 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →