Description
Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. An authenticated, low-privilege user (able to create/edit forms) can inject arbitrary HTML/JS into the Craft Control Panel (CP) builder and integrations views. User-controlled form labels and integration metadata are rendered with dangerouslySetInnerHTML without sanitization, leading to stored XSS that executes when any admin views the builder/integration screens. This vulnerability is fixed in 5.14.7.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| solspace | craft-freeform | >= 5.0.0, < 5.14.7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | solspace/craft-freeform | >= 5.0.0, < 5.14.7 | 5.14.7 | GHSA-jp3q-wwp3-pwv9 |