PT-2026-7943 · WordPress+1 · Freeforum+1

Prav33N-Sec · Publicado 2026-01-22 · Atualizado 2026-02-13 · CVE-2026-26188

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Solspace Freeform plugin for Craft CMS versions 5.0 through 5.14.6

Description A low-privilege authenticated user with form creation/editing permissions can inject arbitrary HTML and JavaScript code into the Craft Control Panel builder and integrations views. Form labels and integration metadata, controlled by the user, are rendered using dangerouslySetInnerHTML without proper sanitization, resulting in stored cross-site scripting (XSS). This allows for the execution of malicious scripts when any administrator views the builder or integration screens.

Recommendations Update to version 5.14.7 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-26188

GHSA-JP3Q-WWP3-PWV9

Produtos afetados

Craft Cms

Freeforum

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26188.json · Exploit
• https://github.com/solspace/craft-freeform/security/advisories/GHSA-jp3q-wwp3-pwv9 · Aviso do Fabricante
• https://github.com/solspace/craft-freeform/commit/b9adad6cdf1eba5400aae8b1ae39bd7d4d33af5e · Correção
• https://github.com/solspace/craft-freeform · Nota
• https://github.com/solspace/craft-freeform/releases/tag/v5.14.7 · Nota
• https://twitter.com/CVEnew/status/2022089623695241590 · Publicação no Twitter
• https://t.me/CVEtracker/44586 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-26188 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-26188 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2022151206068461695 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-jp3q-wwp3-pwv9 · Aviso do Fabricante