CVE-2026-72821

Name of the Vulnerable Software and Affected Versions Grav Form plugin versions prior to 9.1.15

Description A stored cross-site scripting issue exists where radio and toggle field option labels are rendered using the Twig |raw filter. This allows attackers with form authoring permissions to inject HTML and script payloads into option labels, which then execute in the browsers of administrators and visitors who view the form.

Recommendations Update Grav Form plugin to version 9.1.15 or later.