Medium severity5.4NVD Advisory· Published Aug 14, 2026

CVE-2026-72821

Description

Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Grav CMS/Form pluginllm-fuzzy
Range: <9.1.15
Getgrav/Gravllm-fuzzy
Range: <9.1.15

Patches

Vulnerability mechanics

References

github.com/getgrav/grav/security/advisories/GHSA-5xv4-g337-2pg7nvd
www.vulncheck.com/advisories/grav-form-plugin-before-stored-xss-via-radio-togglenvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000