PT-2026-7943 · WordPress+1 · Freeforum+1

Prav33N-Sec · Published 2026-01-22 · Updated 2026-02-13 · CVE-2026-26188

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Solspace Freeform plugin for Craft CMS versions 5.0 through 5.14.6

Description A low-privilege authenticated user with form creation/editing permissions can inject arbitrary HTML and JavaScript code into the Craft Control Panel builder and integrations views. Form labels and integration metadata, controlled by the user, are rendered using dangerouslySetInnerHTML without proper sanitization, resulting in stored cross-site scripting (XSS). This allows for the execution of malicious scripts when any administrator views the builder or integration screens.

Recommendations Update to version 5.14.7 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-26188

GHSA-JP3Q-WWP3-PWV9

Affected Products

Craft Cms

Freeforum

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26188.json · Exploit
• https://github.com/solspace/craft-freeform/security/advisories/GHSA-jp3q-wwp3-pwv9 · Vendor Advisory
• https://github.com/solspace/craft-freeform/commit/b9adad6cdf1eba5400aae8b1ae39bd7d4d33af5e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-26188 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26188 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jp3q-wwp3-pwv9 · Vendor Advisory
• https://github.com/solspace/craft-freeform · Note
• https://github.com/solspace/craft-freeform/releases/tag/v5.14.7 · Note
• https://twitter.com/CVEnew/status/2022089623695241590 · Twitter Post
• https://t.me/CVEtracker/44586 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2022151206068461695 · Twitter Post