PatchTheCVEfreeform vulnerabilities and fixes
Recent CVEs affecting freeform, with upgrade or downgrade steps. 2 tracked.
freeform has 2 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2026-02-12. Highest priority: CVE-2025-52122 (score 57/100).
- CVE-2026-26188 MEDIUM 5.4 UPGRADE Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool
- CVE-2025-52122 CRITICAL 9.8 UPGRADE Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vul
FAQ
How do I fix freeform vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is freeform being exploited right now?
None of the tracked freeform CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which freeform CVE should I patch first?
CVE-2025-52122 currently ranks highest (57/100): Freeform 5.0.0 to before 5.10.16, a plugin for CraftCMS, contains an Server-side template injection (SSTI) vul.