CVE-2026-42842

CVE-2026-42842: Stored XSS in Grav Form plugin (select field) where taxonomy values render via Twig |raw in admin pages, enabling an editor-level user to inject JavaScript that runs in admins’ browsers when viewing/editing pages. Affects Grav CMS Form plugin’s select.html.twig handling and global...

CVE-2026-42842

creationtimestamp| type| source ---|---|--- 2026-04-27 12:15:07+00:00| published-proof-of-concept| https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f...