CVE-2026-26188: Craft CMS Freeform Plugin XSS Vulnerability

CVE-2026-26188 Overview

A stored Cross-Site Scripting (XSS) vulnerability exists in the Solspace Freeform plugin for Craft CMS 5.x. The plugin, which provides flexible form-building capabilities, fails to properly sanitize user-controlled form labels and integration metadata before rendering them in the Craft Control Panel (CP). Specifically, these values are rendered using dangerouslySetInnerHTML without sanitization, allowing an authenticated user with low privileges (able to create/edit forms) to inject arbitrary HTML and JavaScript code that executes when any administrator views the builder or integration screens.

Critical Impact

Authenticated attackers with form creation privileges can inject malicious scripts that execute in the context of administrator sessions, potentially leading to session hijacking, privilege escalation, or further compromise of the Craft CMS installation.

Affected Products

• Solspace Freeform plugin for Craft CMS 5.x versions prior to 5.14.7
• Craft CMS installations using vulnerable Freeform plugin versions

Discovery Timeline

• 2026-02-12 - CVE CVE-2026-26188 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2026-26188

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) stems from improper handling of user-supplied input in the Freeform plugin's React-based frontend components. The vulnerability allows authenticated users with form creation or editing privileges to inject malicious payloads that persist in the database and execute whenever an administrator accesses the affected Control Panel views.

The attack surface is particularly concerning because it targets administrative interfaces, meaning successful exploitation could compromise high-privilege accounts. When an admin navigates to the form builder or integrations screens, the injected JavaScript executes within their authenticated session context.

Root Cause

The root cause is the unsafe use of React's dangerouslySetInnerHTML property without proper input sanitization. Form labels and integration metadata values submitted by users are stored directly in the database and subsequently rendered as raw HTML in the Control Panel interface. This bypasses React's built-in XSS protections that normally escape dynamic content.

Attack Vector

The attack is network-based and requires authentication with minimal privileges—specifically, the ability to create or edit forms within the Freeform plugin. An attacker crafts a malicious form label or integration metadata field containing JavaScript payloads. When saved, the payload persists in the application database. Subsequently, when any administrator views the form builder or integration configuration screens, the stored payload executes in their browser session.

The following patch demonstrates the fix implemented by adding DOMPurify sanitization to the dropdown options component:

 import React, { useEffect, useRef } from 'react';
 import classes from '@ff-client/utils/classes';
+import { sanitize } from 'dompurify';
 
 import CheckIcon from './check.svg';
 import type { DropdownProps } from './dropdown';

Source: GitHub Commit Update

The version bump in the security patch:

 {
   "name": "solspace/craft-freeform",
   "description": "The most flexible and user-friendly form building plugin!",
-  "version": "5.14.6",
+  "version": "5.14.6.1",
   "type": "craft-plugin",
   "authors": [
     {

Source: GitHub Commit Update

Detection Methods for CVE-2026-26188

Indicators of Compromise

• Unusual form labels or integration metadata containing HTML tags such as <script>, <img>, <svg>, or event handlers like onerror, onload
• Unexpected JavaScript execution or browser console errors when loading Freeform builder or integration pages
• Audit log entries showing form modifications by users who should not have administrator-level access patterns

Detection Strategies

• Review Freeform form configurations for suspicious HTML or JavaScript content in label fields and integration metadata
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Monitor browser console output for unexpected script errors or XSS payload signatures when accessing the Control Panel

Monitoring Recommendations

• Enable comprehensive audit logging for all Freeform plugin form creation and modification activities
• Configure web application firewall (WAF) rules to detect XSS payload patterns in form submissions
• Regularly audit user permissions to ensure form creation privileges are restricted to trusted accounts only

How to Mitigate CVE-2026-26188

Immediate Actions Required

• Update Solspace Freeform plugin to version 5.14.7 or later immediately
• Audit existing forms for any potentially malicious content in labels and integration metadata fields
• Review user accounts with form creation privileges and remove access for untrusted users
• Consider temporarily restricting form editing capabilities until the patch is applied

Patch Information

Solspace has released version 5.14.7 of the Freeform plugin which addresses this vulnerability by implementing DOMPurify sanitization for user-controlled content rendered with dangerouslySetInnerHTML. The fix is tracked under issue SFT-2567 and resolves all related code scanning alerts. The patch is available via the GitHub Release v5.14.7. Additional technical details are available in the GitHub Security Advisory GHSA-jp3q-wwp3-pwv9.

Workarounds

• Restrict form creation and editing privileges to only trusted administrator accounts until the patch can be applied
• Implement strict Content Security Policy headers to mitigate XSS impact (though this does not prevent the vulnerability)
• Manually sanitize existing form labels and integration metadata by reviewing and removing any HTML content

# Update Freeform plugin via Composer
composer require solspace/craft-freeform:^5.14.7
php craft migrate/all
php craft project-config/apply