CVE-2026-72821

5.1 mediumEPSS 0.2%

Medium (5.1). EPSS 0.2% chance of exploitation in the next 30 days.

Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-11-01)
CWE: CWE-79
Published: 2026-08-14
Modified: 2026-08-31
Record from: the NVD, synced 2026-10-19

References

https://github.com/getgrav/grav/security/advisories/GHSA-5xv4-g337-2pg7
https://www.vulncheck.com/advisories/grav-form-plugin-before-stored-xss-via-radio-toggle
https://github.com/getgrav/grav/security/advisories/GHSA-5xv4-g337-2pg7

Check your stack JSON