Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
CVE-2026-75107: Grav Form Plugin lets attackers run code in visitors’ browsers
CVE-2026-75107 · published 2 months ago
Summary
The Grav Form Plugin versions before 9.1.19 do not properly clean certain form field settings, so a user who can edit forms can plant hidden HTML or JavaScript. That code will run automatically for anyone who views the form, potentially stealing data or hijacking sessions. Upgrade the plugin to version 9.1.19 or later, and review form templates for any unexpected code.
What to do
- Update getgrav grav to version 9.1.19 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| getgrav | grav | < 9.1.19 |
Original advisory text
Grav Form Plugin before 9.1.19 Stored XSS via Field Properties
Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
5.1
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published18 Aug 2026
Updated4 Nov 2026
First seen18 Aug 2026
Track software like this
Free during beta