Grav Form Plugin EUVD-2026-60590

Exploitation requires a valid Grav CMS account with form-authoring privileges (PR:L per CVSS 4.0 vector). The attacker must have write access to form field-definition properties - specifically prepend, append, spacer text, section text, or select option labels - within the Grav administrative interface or equivalent configuration mechanism. Passive user interaction is required: a victim must load any page that renders the compromised form (UI:P per CVSS 4.0), but no active deception of the victim is necessary. Exploitation is limited to Grav deployments where form-authoring access is granted to users who are not fully trusted administrators; single-administrator sites are not at risk unless admin credentials are separately compromised. The vulnerability is not triggerable by anonymous form submitters - the injection point is exclusively in the form schema authoring workflow, not in form submission handling.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) scoring 5.1 accurately captures the risk profile: network-accessible, low-complexity stored XSS gated on low-level privileges. The PR:L requirement is the dominant real-world risk limiter - exploitation is strictly contingent on the attacker holding a form-authoring account within Grav, ruling out anonymous exploitation. The UI:P (passive user interaction) metric is a notable risk amplifier relative to reflected XSS: victims need only load a page hosting the compromised form, with no phishing or active deception required. No EPSS score was provided in the input data, so exploitation probability cannot be quantified beyond the CVSS signal. No KEV listing exists, confirming no confirmed active exploitation at time of analysis. The subsequent-system impact metrics (SC:L/SI:L) in the CVSS 4.0 vector appropriately reflect the cross-origin JavaScript execution context affecting victim browser sessions. In multi-tenant, agency, or community Grav deployments where contributor-level users are granted form-editing rights, the PR:L threshold is easily met; single-administrator installations are not vulnerable unless admin credentials are separately compromised.

An attacker with a contributor-level Grav CMS account opens a contact or registration form in the admin interface and inserts a JavaScript payload - such as a session-stealing script - into the 'prepend' property of a select field or the spacer text of a form section. The Grav Form Plugin renders this value through a |raw Twig filter without sanitization, embedding the live script tag in every subsequent page load of that form. All visitors - including unauthenticated public users - who load the form page execute the attacker's script in their browser context, enabling session token theft, credential harvesting, or redirection to attacker-controlled infrastructure.