CVE-2026-72821

Grav Form plugin (before v9.1.15) contains a stored XSS in radio and toggle field option labels rendered via Twig |raw. With form authoring permissions, an attacker can inject HTML/script into option labels that executes in the browsers of visitors and admins viewing the form. The issue is caused...