CVE-2026-72821

CVE-2026-72821CVE-2026-72821

Description

Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.

Scoring

CVSS 5.4 ()
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Last modified2026-08-14
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.