Description

Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-14T12:16:45.140Z",
  "pubdate": "2026-08-14T12:16:45.140Z",
  "executiveSummary": "An authenticated Stored Cross-Site Scripting (XSS) vulnerability exists within the Grav Form plugin prior to version 9.1.15.\nThe vulnerability affects radio and toggle field option labels that are improperly rendered using the Twig |raw filter.\nAn attacker possessing form authoring permissions can inject arbitrary HTML and malicious JavaScript payloads directly into the option labels of forms.\nWhen a site visitor or administrator views the affected form frontend or backend administration interface, the injected script executes within the context of the victim browser session.\nThis can lead to unauthorized actions, session hijacking, or defacement.\nExploitation requires authenticated access with permissions to create or modify forms within the Grav CMS environment.\nThe risk implications include potential compromise of administrative accounts and persistent execution of arbitrary code via stored input vectors.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling and rendering of user-supplied option labels for radio and toggle field components within the Grav Form plugin.\nSpecifically, the template rendering engine processes these labels utilizing the Twig |raw filter, which explicitly disables automatic HTML escaping and outputs raw strings directly into the Hypertext Markup Language (HTML) document.\nThe vulnerable component comprises the form rendering logic and associated Twig templates responsible for generating radio and toggle input interfaces.\nAffected software versions include all Grav Form plugin releases prior to version 9.1.15.\nExploitation requires an attacker to possess authentication credentials and specific privileges allowing form authoring capabilities within the Grav content management system.\nThe attack flow proceeds as follows: First, the authenticated attacker accesses the form authoring interface and crafts a malicious form definition containing radio or toggle fields.\nWithin the option labels of these fields, the attacker embeds a malicious cross-site scripting payload, such as a script element containing JavaScript code or event handlers.\nThe attacker saves the form configuration, causing the payload to be persistently stored within the application data storage or configuration files.\nSubsequently, when an unsuspecting administrator or standard site visitor loads the page rendering the form, the server processes the template using the |raw filter, outputting the unescaped payload directly into the response body.\nThe victim browser parses the incoming Hypertext Markup Language and executes the malicious script within the security context of the victim session.\nPost-exploitation impact includes the ability to perform actions on behalf of the victim, access sensitive session tokens, manipulate Document Object Model (DOM) elements, or pivot to further administrative functions if the victim possesses elevated privileges."
}