CyberRota Analysis
AI-GeneratedThe Grav Form Plugin prior to version 9.1.19 is vulnerable due to improper escaping of field-definition properties, allowing attackers with form authoring privileges to inject arbitrary HTML and JavaScript into form templates. This can lead to cross-site scripting (XSS) attacks, impacting all users who visit the affected forms. Organizations using this plugin should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors through unescaped |raw filters and unquoted attributes.