Is CVE-2026-72821 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-72821?

CVE-2026-72821 has a CVSS v3 severity of MEDIUM (5.4).

Back

CVE-2026-72821

Description

Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.