Medium severity5.4NVD Advisory· Published Aug 18, 2026· Updated Sep 8, 2026

CVE-2026-75107

Description

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Grav CMS/Form pluginllm-fuzzy
Range: <9.1.19

Patches

Vulnerability mechanics

References

github.com/getgrav/grav/security/advisories/GHSA-5jrr-wfgh-mhg9nvd
www.vulncheck.com/advisories/grav-form-plugin-before-stored-xss-via-field-propertiesnvd

News mentions

Grav CMS: 14 Vulnerabilities Including Critical Privilege Escalation Disclosed Together
Vypr Intelligence · Aug 19, 2026
Grav CMS: Six Vulnerabilities Including File Write and XSS Disclosed Together
Vypr Intelligence · Aug 18, 2026

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000