CVE-2026-42842CWE-79

grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel

Medium · published May 11, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
16.1
In the wild
Unconfirmed
What it is

The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-11T15:29Z
EPSS history
Timeline
  • 11 MAY 15:29Z
    grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel
    cvelistv5