🛡️ CVE-2026-26188 — freeform

🟡 CVSS 5.4 — Medium ⚠️ Exploit Public CWE-79 NVD
5.4
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue

Summary

An authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to stored XSS that executes when any admin views the builder/integration screens.

Affected Product

  • Ecosystem: Packagist (Craft CMS plugin)
  • Package: solspace/craft-freeform
  • Version: <= 5.14.6 (latest observed). Likely all 5.x until patched.

Details

  • Root cause: Multiple user-controlled strings (field labels, section labels, integration icons, short names, WYSIWYG previews) are injected into React components using dangerouslySetInnerHTML without sanitization.
  • Evidence: dangerouslySetInnerHTML on user-controlled properties in bundled CP JS at [packages/plugin/src/Resources/js/client/client.js](packages/plugin/src/Resources/js/client/client.js#L1).

PoCs

  • Label-based XSS:

1. In Craft CP, create/edit a Freeform field and set its label to <img src=x onerror="alert('xss-label')">.

2. Open the form builder view containing the field.

3. Alert executes (stored XSS).

  • Integration icon SVG:

1. Set an integration "icon SVG" to <svg><script>alert('xss-icon')</script></svg>.

2. Open the integrations CP view.

3. Script executes.

Impact

Arbitrary JS in admin CP; session/CSRF token theft; potential full admin takeover via DOM-driven actions.

Remediation

  • Sanitize/HTML-encode all user-controlled strings before passing to dangerouslySetInnerHTML, or avoid it for labels/titles/icons.
  • Server-side: strip/escape disallowed tags on save for fields, integration metadata, WYSIWYG content.
  • Add regression tests with <img onerror> payloads to ensure no execution in builder/integration views.

Workarounds

  • Restrict form-edit permissions to trusted admins only until patched.
  • Consider CSP that disallows inline scripts (defense-in-depth only).

Credits

  • Discovered by https://www.linkedin.com/in/praveenkavinda/ | Prav33N-Sec.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs low-level privileges on the target. A user must be tricked into taking some action. The scope is changed, meaning a successful attack can affect components beyond the vulnerable one. Rated impact: confidentiality low, integrity low, availability none.

Weakness class

CVE-2026-26188 is classified as CWE-79: Cross-site Scripting (XSS). User-supplied data is written into a page without escaping, so attacker script runs in the browser of anyone who views it.

Affected software

CVE-2026-26188 is recorded against 2 packages.

  • freeform (from 5.0.0 up to 5.14.7)
  • solspace/craft-freeform (from 5.0.0 up to 5.14.7)

Timeline and source

Published on 12 February 2026 and last revised on 17 June 2026. A public exploit is known to exist, which raises the urgency of patching considerably. A vendor advisory or fix has been published. Record sourced from NVD.

References

github.com
github.com
github.com

Details

Severity MEDIUM
CVSS Score 5.4
CVSS Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE CWE-79
Public Exploit ⚠️ Yes
Source NVD
Published 2026-02-12
Updated 2026-08-12
Modified 2026-06-17

Affected Packages

Software From version Fixed in
freeform 5.0.0 5.14.7
solspace/craft-freeform 5.0.0 5.14.7

Similar Threats

Exploit Protection

Are you running freeform?

CVE-2026-26188 carries CVSS 5.4 Medium rating and a public exploit already exists. BotEraser checks your installation against this and other known CVE records, and blocks IPs associated with exploit activity.

Check My Site For CVE-2026-26188 →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.