Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. An authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to stored XSS that executes when any admin views the builder/integration screens. This vulnerability is fixed in 5.14.7.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-26188 Stored XSS in Solspace Freeform Plugin for Craft CMS 5.x via Builder Human hint: https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-26188
Post summary
The text announces a stored XSS vulnerability (CVE-2026-26188) affecting the Solspace Freeform Plugin for Craft CMS 5.x via the Builder component.
CVE-2026-26188 Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. An authenticated, low-privilege user (able to create/edit forms) can inject arbitra… https://www.cve.org/CVERecord?id=CVE-2026-26188
Post summary
The post discloses a code injection vulnerability in the Solspace Freeform plugin that permits authenticated low‑privilege users to inject arbitrary code, but it provides no PoC, exploit, or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | solspace | freeform | - | craft_cms | - |