CVE-2026-72821CWE-79cross-site-scripting

CVE-2026-72821

Medium · published August 14, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
13.6
In the wild
Unconfirmed
What it is

Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00235 · 13.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-14T16:16Z
References (3)
https://github.com/getgrav/grav/security/advisories/GHSA-5xv4-g337-2pg7 · [email protected]https://www.vulncheck.com/advisories/grav-form-plugin-before-stored-xss-via-radio-toggle · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-5xv4-g337-2pg7 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 14 AUG 11:35Z
    Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle
    cvelistv5