CVE-2026-75107CWE-79cross-site-scripting

CVE-2026-75107

Medium · published August 18, 2026

CVSS v3.1
5.4
EPSS
0%
Percentile
13.6
In the wild
Unconfirmed
What it is

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00235 · 13.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-08-18T16:19Z
References (3)
https://github.com/getgrav/grav/security/advisories/GHSA-5jrr-wfgh-mhg9 · [email protected]https://www.vulncheck.com/advisories/grav-form-plugin-before-stored-xss-via-field-properties · [email protected]https://github.com/getgrav/grav/security/advisories/GHSA-5jrr-wfgh-mhg9 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 18 AUG 11:19Z
    Grav Form Plugin before 9.1.19 Stored XSS via Field Properties
    cvelistv5