01 Record

CVE-2026-72821

Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle

MediumPUBLISHEDCNA: VulnCheck

Base score5.1 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

02 Description

Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle

Published: 2026-08-14 11:35Z6 HR AGO
Last updated: 2026-08-14 11:35Z6 HR AGO
Reserved: 2026-08-10
Assigning CNA: VulnCheck
Record state: PUBLISHED
Severity: Medium (CVSS 5.1)
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Weaknesses: CWE-79
SSVC decision: No CISA-ADP assessment
Data version: 5.2
Document digest: d4741b7879b40030d69d4e6ace7de8a941e71b657e6bccdf2bebb35a77070473

VendorProductVersionsPlatforms

getgravgrav0 to < 9.1.15—

github.comGitHub Security Advisory (GHSA-5xv4-g337-2pg7)https://github.com/getgrav/grav/security/advisories/GHSA-5xv4-g337-2pg7vendor-advisory
www.vulncheck.comVulnCheck Advisory: Grav Form Plugin before 9.1.15 Stored XSS via Radio Togglehttps://www.vulncheck.com/advisories/grav-form-plugin-before-stored-xss-via-radio-togglethird-party-advisory