GHSA-JP3Q-WWP3-PWV9

Freeform, Free Execution: Stored XSS in Craft CMS's Favorite Form Builder

Alon Barad
Alon Barad
Software Engineer

Jan 22, 2026·6 min read·5 visits

Executive Summary (TL;DR)

The Solspace Freeform plugin (versions <= 5.14.6) for Craft CMS contains a Stored XSS vulnerability in its Form Builder and Integrations views. Because the plugin renders user-controlled labels and SVG icons using React's `dangerouslySetInnerHTML` without sanitization, an attacker with basic 'edit form' permissions can inject malicious JavaScript. When an administrator views the compromised form builder, the script executes, leading to session hijacking and potential full site takeover.

A high-severity Stored Cross-Site Scripting (XSS) vulnerability in the Solspace Freeform plugin for Craft CMS allows low-privileged users to hijack administrator sessions via the Control Panel.

Technical Appendix

CVSS Score
8.2/ 10
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS Probability
0.04%
Top 100% most exploited

Affected Systems

Craft CMSSolspace Freeform Plugin

Affected Versions Detail

Product
Affected Versions
Fixed Version
solspace/craft-freeform
Solspace
<= 5.14.65.14.7
AttributeDetail
Vulnerability TypeStored Cross-Site Scripting (XSS)
Attack VectorNetwork (Authenticated)
SeverityHigh / Critical (Context Dependent)
ComponentFreeform Control Panel (Form Builder & Integrations)
Root CauseUnsanitized dangerouslySetInnerHTML usage
Authentication RequiredYes (Low Privilege)
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Vulnerability Timeline

Vulnerability Disclosed / Published
2026-01-22
GHSA-JP3Q-WWP3-PWV9 Assigned
2026-01-22

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.