CVE-2026-42842

grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel

View on CVE.org
Published May 11, 2026 CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Description
The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0.

Analysis

AI-generated

Technical impact

The Grav form plugin renders taxonomy tag and category values in the admin panel using Twig’s |raw filter, bypassing autoescape protection. This flaw permits an editor‑level user to inject persistent JavaScript that runs whenever an administrator views or edits a page. The injected code is stored and can be reused across sessions, making the attack repeatable in the administrative context.

Affected Systems

Grav CMS and its Grav Form Plugin, distributed by getgrav. Versions of the form plugin prior to 9.1.0 are vulnerable. The issue is resolved in release 9.1.0, so any deployment using an earlier plugin version is impacted.

Risk and Exploitability

The CVSS score is 5.4, indicating moderate severity. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited known exploitation. Exploitation requires an attacker to have editor privileges in order to add or modify taxonomy field values; the attack then triggers when an administrator opens the affected page for viewing or editing.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Grav form plugin to version 9.1.0 or later; this release removes the raw rendering of taxonomy field values.
  • If an immediate upgrade is not feasible, remove or sanitize any taxonomy field values that contain malicious content or disable the select field template that renders taxonomy tags.
  • Restrict editor‑level access to trusted personnel and monitor taxonomy input for unexpected characters.

Generated by OpenCVE AI on May 11, 2026 at 18:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Github GHSA Github GHSA GHSA-c2q3-p4jr-c55f Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel
History
Type Values Removed Values Added
First Time appeared Getgrav
Getgrav grav
Getgrav grav-plugin-form
Vendors & Products Getgrav
Getgrav grav
Getgrav grav-plugin-form
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0.
Title grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
May 11, 2026, 6:25 PM
Reserved
Apr 30, 2026, 4:44 PM

View source JSON

Updated
May 11, 2026, 6:25 PM

JSON

Status
Deferred
Published
May 11, 2026, 5:16 PM
Modified
Oct 26, 2026, 6:10 PM

View source JSON

No data.

Updated
May 12, 2026, 9:23 AM

JSON