MEDIUM 5.1 NVD
CVE-2026-75107
Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in for
Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.
References
- https://github.com/getgrav/grav/security/advisories/GHSA-5jrr-wfgh-mhg9
- https://www.vulncheck.com/advisories/grav-form-plugin-before-stored-xss-via-field-properti
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-08-18 via NVD.
vulnfeed aggregates 11001 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.