CVE-2026-26188
Medium
Description
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. An authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to stored XSS that executes when any admin views the builder/integration screens. This vulnerability is fixed in 5.14.7.
SeverityMedium
CVSS5.4
Exploit probability—
ProductSolspace Freeform
PublishedFeb 12, 2026
First seenFeb 12, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- solspace freeform5.14.7 or later
- solspace/craft-freeform5.14.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| solspace freeform | 5.0.0 ≤ v < 5.14.7 | 5.14.7 |
| solspace/craft-freeformPackagist | 5.0.0 ≤ v < 5.14.7 | 5.14.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.