CyberRota Analysis
AI-GeneratedThe Grav Form plugin prior to version 9.1.15 is vulnerable to a stored cross-site scripting (XSS) flaw, allowing attackers with form authoring permissions to inject malicious HTML and script payloads into radio and toggle field option labels. This vulnerability can lead to the execution of harmful scripts in the browsers of both visitors and administrators interacting with the affected forms. Organizations using this plugin should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav Form plugin versions before 9.1.15 contain a stored cross-site scripting vulnerability in radio and toggle field option labels rendered with the Twig |raw filter. Attackers with form authoring permissions can inject HTML and script payloads in option labels that execute in the browsers of visitors and administrators viewing the form.