Executive brief
Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue
Affected products
- Packagist solspace/craft-freeform
Junglewise Threat Intelligence
CVE-2026-26188: Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue
CVE-2026-26188 · Severity: medium · CVSS 4 · Published 2026-01-22
Technologies: solspace/craft-freeform (Packagist). Vendors: Packagist.
Related threats
- Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public
- solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data
- solspace/craft-freeform Has a DoS Vulnerability
- The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability