CVE-2026-42842

The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0.

• CWE-79

• https://github.com/getgrav/grav-plugin-form/commit/6bffb4c98be468a155d1656544ec45bb4a443957
• https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f
• https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-42837Out-of-bounds read in Windows Projected File System Filter D…7.8
• CVE-2026-42838Improper neutralization of special elements in output used b…5.4
• CVE-2026-42839An authenticated ERPNext user with Item record edit permissi…4.8
• CVE-2026-4284A vulnerability was determined in taoofagi easegen-admin up …4.7
• CVE-2026-42840An authenticated user can persist arbitrary HTML/JavaScript …5.1
• CVE-2026-42841Grav is a file-based Web platform. Prior to 2.0.0-beta.2, an…4.8
• CVE-2026-42843Grav API Plugin is a RESTful API for Grav CMS that provides …8.8
• CVE-2026-42844Grav is a file-based Web platform. In Grav 2.0.0-beta.2, a l…8.8
• CVE-2026-42845The form plugin for Grav adds the ability to create and use …7.7
• CVE-2026-42846ClipBucket v5 is an open source video sharing platform. Prio…9.8
• CVE-2026-42847ClipBucket v5 is an open source video sharing platform. Prio…7.1
• CVE-2026-42849authentik is an open-source identity provider. Prior to vers…9.3