CVE-2026-72821
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Grav Form plugin before version 9.1.15 contains a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.
Risk Assessment
The risk includes data theft, administrator session hijacking, and spreading malicious code among users, potentially leading to system integrity and trust compromise.
Recommendation
Immediately update the Grav Form plugin to version 9.1.15 or later and review existing forms for suspicious option labels.
Original NVD description (English source)
Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.