CVE-2026-75107 in Form Plugin
Summary
by MITRE • 08/18/2026
Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The Grav Form Plugin prior to version 9.1.19 contains a critical Cross-Site Scripting vulnerability stemming from insufficient input validation and output encoding mechanisms within its template rendering engine. This flaw specifically affects the handling of field-definition properties, including prepend text, append text, spacer content, section headers, and select option labels. When form authors define these elements using unescaped raw filters or improperly quoted attributes in their configuration files, the system fails to sanitize the input before injecting it into the HTML structure. Consequently, any special characters intended for markup interpretation are passed through directly to the browser without being converted into safe entities, creating a direct pathway for malicious script injection.
From an operational perspective, this vulnerability allows attackers who possess form authoring privileges on the Grav platform to execute arbitrary JavaScript code in the context of all visitors viewing forms that utilize these compromised fields. The impact is severe because it enables session hijacking, credential theft via keylogging scripts, defacement of the user interface, or redirection to phishing sites. Since the execution occurs for every visitor who interacts with the affected form, a single malicious configuration change by an authorized but potentially compromised account can lead to widespread compromise across the entire site audience. The attack vector relies on social engineering or credential theft targeting users with editing rights rather than exploiting external network vulnerabilities directly.
This vulnerability aligns closely with CWE-79, which classifies improper neutralization of input during web page generation as a classic Cross-Site Scripting flaw. Furthermore, in the context of the MITRE ATT&CK framework, this behavior corresponds to techniques involving client-side code injection and potentially account manipulation if session tokens are exfiltrated. The root cause lies in the reliance on raw output filters that bypass automatic escaping mechanisms provided by modern web frameworks, combined with attribute values that lack proper quoting boundaries, allowing script tags or event handlers like onclick to break out of their intended string context.
To mitigate this risk, administrators must upgrade the Grav Form Plugin to version 9.1.19 or later immediately upon availability. This update implements strict output encoding for all dynamic content rendered in form templates and enforces proper attribute quoting standards. Additionally, organizations should review existing forms for any custom configurations that use raw filters on user-controllable fields such as labels or spacer text. Implementing a Content Security Policy with restrictive script-src directives can also provide an additional layer of defense by preventing the execution of unauthorized inline scripts even if injection attempts succeed. Regular audits of form author permissions and principle-of-least-privilege enforcement are recommended to reduce the attack surface for this specific vector.