Medium severity5.4NVD Advisory· Published Aug 14, 2026· Updated Aug 31, 2026
CVE-2026-72821
CVE-2026-72821
Description
Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <9.1.15
Patches
Vulnerability mechanics
References
2News mentions
1- Grav CMS: Eleven Vulnerabilities Disclosed, Including Critical API Privilege EscalationVypr Intelligence · Aug 14, 2026