CVE-2026-26188 in craft-freeform
Summary
by MITRE • 02/13/2026
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. An authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to stored XSS that executes when any admin views the builder/integration screens. This vulnerability is fixed in 5.14.7.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 02/21/2026
The vulnerability identified as CVE-2026-26188 affects the Solspace Freeform plugin for Craft CMS 5.x, representing a critical stored cross-site scripting flaw that undermines the security of the content management system's control panel. This issue specifically targets authenticated users who possess limited privileges to create and edit forms, yet the vulnerability allows them to escalate their access by injecting malicious code into the system's administrative interfaces. The flaw exists within the plugin's handling of user-generated content in form labels and integration metadata fields, where the application fails to properly sanitize or escape user input before rendering it within the control panel environment.
The technical implementation of this vulnerability stems from the application's reliance on dangerouslySetInnerHTML React pattern when rendering form builder and integration views. This approach bypasses React's built-in security mechanisms that normally protect against XSS attacks by automatically escaping HTML content. When an attacker with form creation privileges submits malicious HTML or JavaScript code within form labels or integration metadata, the system stores this content without proper sanitization. The vulnerability is particularly concerning because the stored malicious code executes automatically whenever any administrator accesses the affected control panel screens, making it a persistent threat that can affect multiple users over time.
The operational impact of this vulnerability extends beyond simple code injection, as it provides attackers with the ability to execute arbitrary JavaScript within the context of the administrator's browser session. This creates numerous potential attack vectors including session hijacking, data exfiltration, privilege escalation, and the potential for lateral movement within the affected system. The vulnerability affects the Craft CMS control panel builder and integration views, meaning that any administrative user who accesses these interfaces becomes a potential victim of the stored XSS attack. The attack requires only a low-privilege user account with form creation capabilities, making it particularly dangerous as it can be exploited by users who should not have elevated access rights.
Security professionals should note that this vulnerability aligns with CWE-79 (Cross-site Scripting) and follows patterns commonly associated with ATT&CK technique T1566.001 (Phishing: Spearphishing Attachment) and T1566.002 (Phishing: Spearphishing Link) when considering how attackers might leverage this vulnerability to establish persistent access. The fix implemented in version 5.14.7 addresses the root cause by implementing proper input sanitization and output encoding for all user-controllable form elements before rendering them in the control panel. Organizations should prioritize immediate patching of affected systems and implement additional monitoring for suspicious form creation activities, particularly when users submit content containing unusual HTML or JavaScript patterns. The vulnerability demonstrates the critical importance of proper input validation and output encoding in web applications, especially within administrative interfaces where the potential for damage is significantly amplified.
This vulnerability represents a textbook example of how insufficient sanitization of user input can lead to severe security consequences in content management systems. The fact that it affects a widely used plugin for Craft CMS makes it particularly concerning for organizations relying on this platform, as the attack surface extends to any system running vulnerable versions of the Solspace Freeform plugin. The remediation approach taken by the vendor emphasizes the importance of implementing defense-in-depth strategies, including proper content security policies, regular security audits of third-party plugins, and maintaining up-to-date software versions to protect against known vulnerabilities. Organizations should also consider implementing additional security controls such as web application firewalls and regular penetration testing to identify similar issues within their application ecosystems.