CVE-2026-72821: Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-14 · updated 2026-08-31
Weakness: CWE-79

Description

Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.

Affected products

getgrav grav: before 9.1.15 — fixed in 9.1.15

How to fix

Upgrade to a fixed version: getgrav grav 9.1.15. Check the vendor advisory for mitigations.

References

https://github.com/getgrav/grav/security/advisories/GHSA-5xv4-g337-2pg7
https://www.vulncheck.com/advisories/grav-form-plugin-before-stored-xss-via-radio-toggle
https://github.com/getgrav/grav/security/advisories/GHSA-5xv4-g337-2pg7

Get alerted when CVE-2026-72821 or the next vulnerability affects your stack