Executive brief
solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data
Affected products
- Packagist solspace/craft-freeform
Junglewise Threat Intelligence
solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data
Severity: medium · CVSS 4 · Published 2026-01-15
Technologies: solspace/craft-freeform (Packagist). Vendors: Packagist.
Related threats
- Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public
- Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue
- solspace/craft-freeform Has a DoS Vulnerability
- The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability