Authenticated users with only form creation or editing rights can embed custom HTML or JavaScript inside form labels and integration metadata, which are rendered through a framework function that allows raw HTML injection without sanitization. When any administrator views the form builder or integration screens, the injected code executes in the context of the administrator’s browser, providing a stored XSS vector that can perform actions such as credential theft or session hijacking. This vulnerability is classified as a stored cross‑site scripting weakness.

All versions of the Solspace Freeform plugin for Craft CMS 5.x released before version 5.14.7 are affected, regardless of the specific minor revision. Users should verify that they are running the approved version and apply updates accordingly.

The vulnerability carries a CVSS score of 5.1, indicating a moderate severity, and an EPSS score below 1 %, which reflects a very low probability of exploitation at present. The exploit requires authenticated access with permission to create or edit forms; therefore, the attack is limited to users who already possess some level of control over the form system, and the impact is confined to the Pantheon Control Panel interface where the malicious content is rendered.