Medium severity5.4NVD Advisory· Published Aug 18, 2026

CVE-2026-75107

Description

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.

Affected products

Grav CMS/Form pluginllm-fuzzy
Range: <9.1.19
Grav CMS/Gravllm-fuzzy
Range: <9.1.19

Patches

Vulnerability mechanics

References

github.com/getgrav/grav/security/advisories/GHSA-5jrr-wfgh-mhg9nvd
www.vulncheck.com/advisories/grav-form-plugin-before-stored-xss-via-field-propertiesnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000