CVE-2026-42842
published 2026-05-11CVE-2026-42842: The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS…
PriorityP426medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.15%
4.6th percentile
The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getgrav | grav | < 2.0.0-beta.2 | 2.0.0-beta.2 |
| getgrav | grav | >= 0 < 2.0.0-beta.2 | 2.0.0-beta.2 |
| getgrav | grav-plugin-form | < 9.1.0 | 9.1.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
getgrav grav/grav-plugin-form cross site scripting (GHSA-c2q3-p4jr-c55f)
vuldb·2026-05-11·CVSS 5.4
CVE-2026-42842 [MEDIUM] getgrav grav/grav-plugin-form cross site scripting (GHSA-c2q3-p4jr-c55f)
A vulnerability was found in getgrav grav and grav-plugin-form and classified as problematic. Impacted is an unknown function. The manipulation results in cross site scripting.
This vulnerability is known as CVE-2026-42842. It is possible to launch the attack remotely. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel
ghsa·2026-05-05
CVE-2026-42842 [MEDIUM] CWE-79 Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel
Grav Vulnerable to XSS via Taxonomy Field Values in Admin Panel
### Summary
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig `|raw` filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel.
Additionally, Grav's built-in XSS detection (`Security::detectXss()`) can be bypassed by using payloads that close the `/` context and use unquoted event handlers - the `on_events` regex fails to match event handlers without quotes or trailing spaces before `>`.
### Important
- The vulnerability is in the Form p
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-11
Published