CVE-2026-72821 getgrav CVE debrief

Who should care

Administrators and users of Grav Form plugin versions before 9.1.15 should be aware of the potential XSS vulnerability and take steps to mitigate it. This includes updating to a patched version, restricting form authoring permissions to trusted users, monitoring form submissions for suspicious activity, and implementing additional security measures to prevent XSS attacks. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM, indicating a moderate level of risk. Therefore, it is essential for administrators and users to take proactive measures to prevent potential attacks. Additionally, security teams and vulnerability management teams should also be aware of this vulnerability and review their systems to ensure they are not exposed. They should also verify that their systems are updated with the latest security patches and monitor their systems for suspicious activity. Furthermore, asset inventory and change management teams should review their systems to ensure that they are up-to-date and that any changes are properly documented and verified. Overall, a coordinated effort is required to mitigate this vulnerability and prevent potential attacks. It is also recommended to review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-

Technical summary

The Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads that execute in the browsers of visitors and administrators viewing the form. This vulnerability has a CVSS score of 5.1 and a severity of MEDIUM. The CVE record was published on 2026-08-14T12:16:45.140Z and has not been modified since then.

Defensive priority

Administrators and users of Grav Form plugin versions before 9.1.15 should prioritize updating to a patched version to prevent potential XSS attacks.

Recommended defensive actions

• Update Grav Form plugin to version 9.1.15 or later
• Restrict form authoring permissions to trusted users
• Monitor form submissions for suspicious activity
• Implement additional security measures to prevent XSS attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE-2026-72821 record indicates a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter in Grav Form plugin versions before 9.1.15. Attackers with form authoring permissions can inject HTML and script payloads that execute in the browsers of visitors and administrators viewing the form.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.