CVE-2026-72821 in Form Plugin
Summary
by MITRE • 08/14/2026
Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/14/2026
The vulnerability resides within the Grav Form plugin ecosystem where versions prior to 9.1.15 fail to properly sanitize user input when rendering radio and toggle field option labels. This stored cross-site scripting flaw specifically manifests when the Twig template engine processes these labels using the |raw filter, which bypasses standard HTML escaping mechanisms. The vulnerability is particularly dangerous because it allows attackers with form authoring permissions to inject malicious payloads directly into form option labels that persist in the system's database. When visitors or administrators view forms containing these malicious labels, the injected scripts execute within their browser context, potentially compromising their sessions and accessing sensitive data.
The technical implementation of this vulnerability follows a classic stored xss pattern where user-controllable input flows through a rendering pipeline without adequate sanitization. The Twig |raw filter intentionally disables output escaping to preserve formatting in legitimate use cases, but this creates an attack surface when combined with untrusted user input from form option labels. The affected components include radio buttons and toggle switches that display option labels, making them prime targets for malicious injection attacks. This vulnerability directly maps to CWE-79 - Improper Neutralization of Input During Web Page Generation, which encompasses stored cross-site scripting scenarios where attacker-controlled data is rendered in web pages without proper sanitization.
The operational impact extends beyond simple script execution as attackers can leverage this vulnerability to steal session cookies, redirect users to malicious sites, or perform actions on behalf of authenticated users. Administrators who view forms containing malicious labels become potential victims, creating a persistent threat that remains active until the affected plugin is updated. The attack vector requires minimal privileges since form authoring permissions are typically granted to users who need to modify content, making this vulnerability particularly concerning in multi-user environments where less privileged individuals might gain elevated access through form modifications.
Mitigation strategies must address both immediate remediation and long-term prevention measures. The primary recommendation involves upgrading to Grav Form plugin version 9.1.15 or later where proper input sanitization has been implemented for option labels. Organizations should also implement strict input validation policies for all form field configurations, ensuring that user-provided content undergoes appropriate sanitization before storage. Additionally, security teams should consider implementing content security policies to limit the execution scope of injected scripts and monitor form modification activities through logging mechanisms. This vulnerability aligns with several ATT&CK techniques including T1566 - Phishing and T1059 - Command and Scripting Interpreter, demonstrating how seemingly benign form functionality can become a gateway for more sophisticated attacks.
The broader implications highlight the importance of secure coding practices in web application frameworks where template engines provide powerful rendering capabilities but require careful input handling. This vulnerability serves as a reminder that even specialized components like form builders must maintain robust security controls against injection attacks. Organizations should conduct regular security assessments of their content management systems to identify similar vulnerabilities in other plugins and themes, ensuring comprehensive protection across their digital infrastructure. The incident underscores the need for defense-in-depth strategies that combine automated patching with proactive monitoring and input validation across all user-modifiable content areas.