The Grav Form Plugin prior to version 9.1.19 does not escape field such as prepend content, append content, spacer text, section text, or select-option labels. As a result, an attacker who has the ability to author a form can inject raw HTML or JavaScript into these properties. Because the plugin passes the injected content directly to the form template via an unescaped |raw filter and leaves attribute values unquoted, the malicious code is rendered and executed in the browsers of every user who visits the form. The impact is a classic stored cross‑site scripting vulnerability that can be used for phishing, session hijacking, or other client‑side attacks.

The vulnerability affects installations of Grav CMS that include the Grav Form Plugin before 9.1.19. Any form that utilizes field properties such as prepend, append, spacer, section, or select-option labels is susceptible, provided the form authoring privilege is available to the attacker. The affected product is identified as getgrav:grav with plugin versions earlier than 9.1.19.

The CVSS score of 5.1 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Exploitation requires form author privileges; once the malicious field is created, all form visitors render the payload. The risk profile is thus medium, contingent on the presence of trusted form authors who could be compromised or malicious.