Skip to content
OpenAdvisories

Product · getgrav

grav-plugin-form

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-86194

    Grav Form Plugin before 9.1.22 Cross-Page Form Execution

    Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a res…

    getgrav grav-plugin-form
  • Medium 5.3
    CVE-2026-85602

    Grav Form Plugin before 9.1.20 reCAPTCHA v3 Authentication Bypass

    The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which response field key is present in the submitted payload. On a site configured for reCAPTCHA v3, an anonymous attacker c…

    getgrav grav-plugin-form
  • Medium 6.5
    CVE-2026-69087

    Grav Form Plugin before 9.1.13 Open Redirect via form.value() Twig

    The Grav form plugin (getgrav/grav-plugin-form) before 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect() accepts external URLs without ori…

    getgrav grav-plugin-form
  • Medium 5.4
    CVE-2026-42842

    grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel

    The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw f…

    getgrav grav grav-plugin-form getgrav/grav Packagist