CVE-2026-75107
MediumCVSS 5.4Summary
Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.
Risk Assessment
The risk is the possibility of executing malicious scripts in the browsers of all form visitors, which can lead to data theft, session hijacking, or other attacks. The vulnerability can be exploited by users with form authoring privileges.
Recommendation
It is recommended to upgrade the Grav Form Plugin to version 9.1.19 or later, which includes the fix. Also review form templates to ensure all properties are properly escaped.
Original NVD description (English source)
Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.