Description

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-18T12:19:31.593Z",
  "pubdate": "2026-08-18T12:19:31.593Z",
  "executiveSummary": "The Grav Form Plugin prior to version 9.1.19 suffers from an improper input validation and output encoding vulnerability that leads to Stored Cross-Site Scripting (XSS).\nThe security flaw affects form templates within the Grav Form Plugin, specifically impacting field-definition properties such as prepend, append, spacer text, section text, and select option labels.\nThe vulnerability allows authenticated users with form authoring privileges to inject arbitrary HTML and malicious JavaScript payloads into form definitions.\nWhen form visitors access the rendered forms, the injected scripts execute within the context of the victim's browser session due to the utilization of unescaped filters like |raw and unquoted HTML attributes.\nThis behavior introduces significant risk implications, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.\nSuccessful exploitation requires the attacker to possess form authoring privileges within the Grav CMS administration interface, restricting the attack vector to authenticated users with specific administrative capabilities.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of proper output escaping and context-aware sanitization within the Grav Form Plugin templating mechanism prior to version 9.1.19.\nSpecifically, form-definition properties including prepend, append, spacer text, section text, and select option labels fail to undergo adequate sanitization before being rendered in the Document Object Model (DOM).\nThe application improperly handles these properties by rendering them via unescaped filters, such as the Twig |raw filter, combined with unquoted HTML attributes.\nAttackers with form authoring privileges can exploit this behavior by crafting malicious form YAML configurations or administrative inputs containing arbitrary HTML and JavaScript payloads.\nThe attack flow proceeds as follows: First, the authenticated attacker creates or modifies a form definition within the Grav CMS, inserting malicious JavaScript into vulnerable properties like select option labels or append/prepend text fields.\nSecond, the Grav CMS stores this malicious form definition in the backend storage mechanism without sanitizing the injected input.\nThird, when an unsuspecting user visits or interacts with the rendered form on the frontend, the server processes the form template and outputs the unescaped properties directly into the HTML response using the |raw filter.\nFinally, the victim's web browser parses the response, executing the injected JavaScript payload in the context of the victim's session.\nBecause the payload executes in the visitor's browser, the attacker can leverage this execution to steal session cookies, capture sensitive data, or perform unauthorized administrative or user-level actions.\nThe vulnerable component is the form rendering logic of the Grav Form Plugin across all versions preceding 9.1.19.\nThe attack requires authentication and form authoring privileges, operating against the network exposure of the web application frontend where forms are rendered to visitors."
}