Medium
grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel
Type: advisorySources: OSV
The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-42842
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 05:59 UTC · Revision 1
Source evidence
grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel
core-osv · Original sourcePublished 11 May 2026, 15:29 UTC
The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0.
osv:CVE-2026-42842
Complete source record
{
"id": "366dbb8600c9576693c3cabd51301f78eebaf4379c6683e2306afe418138272f",
"url": "https://osv.dev/vulnerability/CVE-2026-42842",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel",
"summary": "The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0.",
"evidence": "osv:CVE-2026-42842",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-42842",
"aliases": [
"CVE-2026-42842",
"GHSA-c2q3-p4jr-c55f"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/getgrav/grav",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "3077b04b220318883ed34b6ae2a6cd0f25dba92e"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "2.0.0-beta.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
}
]
}
},
{
"repo": "https://github.com/getgrav/grav-plugin-form",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "1d7124647e8d895e01d105bf353a46358dc25549"
},
{
"fixed": "6bffb4c98be468a155d1656544ec45bb4a443957"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "9.1.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "6bffb4c98be468a155d1656544ec45bb4a443957"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"2.0.0-beta.1",
"1.8.0-beta.29",
"1.8.0-beta.28",
"1.8.0-beta.27",
"1.8.0-beta.26",
"1.8.0-beta.25",
"1.8.0-beta.24",
"1.8.0-beta.23",
"1.8.0-beta.22",
"1.8.0-beta.21",
"1.8.0-beta.20",
"1.8.0-beta.19",
"1.8.0-beta.18",
"1.8.0-beta.17",
"1.8.0-beta.16",
"1.8.0-beta.15",
"1.8.0-beta.14",
"1.8.0-beta.13",
"1.8.0-beta.12",
"1.8.0-beta.11",
"1.8.0-beta.10",
"1.8.0-beta.9",
"1.8.0-beta.8",
"1.8.0-beta.7",
"1.8.0-beta.6",
"1.8.0-beta.5",
"1.8.0-beta.4",
"1.8.0-beta.3",
"1.8.0-beta.2",
"1.8.0-beta.1",
"1.7.0-rc.20",
"1.7.0-rc.19",
"1.7.0-rc.18",
"1.7.0-rc.17",
"1.7.0-rc.15",
"1.7.0-rc.14",
"1.7.0-rc.13",
"1.7.0-rc.12",
"1.7.0-rc.10",
"1.7.0-rc.9",
"1.7.0-rc.8",
"1.7.0-rc.7",
"1.7.0-rc.6",
"1.7.0-rc.5",
"1.7.0-rc.4",
"1.7.0-rc.3",
"1.7.0-rc.2",
"1.7.0-rc.1",
"1.7.0-beta.10",
"1.7.0-beta.9",
"1.7.0-beta.8",
"1.7.0-beta.7",
"1.7.0-beta.6",
"1.7.0-beta.5",
"1.7.0-beta.4",
"1.7.0-beta.3",
"1.7.0-beta.2",
"1.7.0-beta.1",
"1.6.0-rc.4",
"1.6.0-rc.3",
"1.6.0-rc.2",
"1.6.0-rc.1",
"1.6.0-beta.8",
"1.6.0-beta.7",
"1.6.0-beta.6",
"1.6.0-beta.5",
"1.6.0-beta.2",
"1.6.0-beta.1",
"1.5.0-rc.1",
"1.5.0-beta.2",
"1.5.0-beta.1",
"1.3.0-rc.5",
"1.3.0-rc.4",
"1.3.0-rc.3",
"1.3.0-rc.1",
"1.2.0-rc.3",
"1.2.0-rc.2",
"1.2.0-rc.1",
"1.1.9-rc.3",
"1.1.9-rc.2",
"1.1.9-rc.1",
"1.1.0-rc.3",
"1.1.0-rc.2",
"1.1.0-rc.1",
"1.1.0-beta.5",
"1.1.0-beta.4",
"1.1.0-beta.3",
"1.1.0-beta.2",
"1.1.0-beta.1",
"0.9.19",
"0.9.18",
"0.9.17",
"0.9.16",
"0.9.15",
"0.9.14",
"0.9.13",
"0.9.12",
"0.9.11",
"0.9.10",
"0.9.9",
"0.9.8",
"0.9.7",
"0.9.6",
"0.9.5",
"0.9.4",
"0.9.3",
"0.9.2",
"0.9.0",
"0.8.0",
"8.2.1",
"8.2.0",
"8.1.0",
"8.0.6",
"8.0.5",
"8.0.4",
"8.0.3",
"8.0.2",
"8.0.1",
"8.0.0",
"7.4.2",
"7.4.1",
"7.4.0",
"7.3.0",
"7.2.2",
"7.2.1",
"7.2.0",
"7.1.3",
"7.1.2",
"7.1.1",
"7.1.0",
"7.0.2",
"7.0.1",
"7.0.0",
"6.0.4",
"4.0.0",
"3.0.0-rc.4",
"3.0.0-rc.3",
"3.0.0-rc.2",
"3.0.0-rc.1",
"3.0.0-beta.5",
"3.0.0-beta.4",
"3.0.0-beta.3",
"3.0.0-beta.2",
"3.0.0-beta.1",
"2.8.0-rc.2",
"2.8.0-rc.1",
"2.0.8-rc.1",
"2.0.0-rc.1",
"1.3.0-rc.2",
"1.3.0-beta.6",
"1.3.0-beta.4",
"1.3.0-beta.3",
"1.3.0-beta.2",
"1.3.0-beta.1",
"0.7.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42842.json"
}
}
],
"modified": "2026-10-28T02:30:49.814956032Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42842.json",
"https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f",
"https://nvd.nist.gov/vuln/detail/CVE-2026-42842",
"https://github.com/getgrav/grav-plugin-form/commit/6bffb4c98be468a155d1656544ec45bb4a443957"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42842.json"
}
},
"related_cves": [
{
"value": "CVE-2026-42842",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 518419,
"published_at": "2026-05-11T15:29:36.49+00:00"
}