[LOW] Freeform Craft Plugin CP UI (builder/integrations) has Stored Cross-Site Scripting (XSS) issue

PKSA-xc3n-vk9q-z5t5 CVE-2026-26188 GHSA-jp3q-wwp3-pwv9

Affected version: >=5.0.0,<=5.14.6

Reported by:
GitHub

[LOW] solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets

PKSA-59fn-718f-htt1 GHSA-rwr8-xrpw-9qf5

Affected version: >=5.0.0-beta.1,<5.5.9|<4.1.22

Reported by:
GitHub

[LOW] solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data

PKSA-p441-f62y-b6vk GHSA-44jg-mv3h-wj6g

Affected version: <4.1.23

Reported by:
GitHub

[LOW] solspace/craft-freeform Has a DoS Vulnerability

PKSA-yj2s-d62t-kqt4 GHSA-58q2-9x27-h2jm

Affected version: <4.1.29

Reported by:
GitHub

[CRITICAL] The Freeform CraftCMS plugin contains an Server-side template injection (SSTI) vulnerability

PKSA-tpdv-c7w9-v16r CVE-2025-52122 GHSA-9hp3-f5g8-rccg

Affected version: >=5.0.0,<5.10.16

Reported by:
GitHub