CVE-2026-42842: Grav Form Plugin Stored XSS in select field template

CVE-2026-42842 · Severity: medium · CVSS 5.4 · Published 2026-05-11

A security vulnerability in the Grav CMS Form plugin allows users with 'editor' permissions to execute malicious code in the browsers of site administrators. By adding specially crafted tags or categories to a page, an attacker can trigger this code whenever an administrator views or edits any page in the management panel. This could allow an attacker to perform unauthorized administrative actions, such as creating new users or changing system settings, by hijacking the administrator's active session.

Technologies: Grav Form Plugin, Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-42842 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42842 being exploited in the wild.
How severe is CVE-2026-42842?
Medium severity, with a CVSS score of 5.4, published 11 May 2026.
Which products and versions are affected?
Grav Form < 9.1.0; Grav Form Plugin < 9.0.1; Grav < 9.1.0; Grav CMS Core < 2.0.0-beta.2; and 1 more.
Is there a fix for CVE-2026-42842?
Yes. getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42842 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42842?
Check whether you run Grav Form, Grav Form Plugin, Grav or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getgrav/grav (Packagist): upgrade to 2.0.0-beta.2 or later
    composer require getgrav/grav:^2.0.0-beta.2

Technical details

A stored XSS vulnerability exists in the Grav CMS Form plugin due to the use of the Twig '|raw' filter in the select field template (select.html.twig). This filter bypasses auto-escaping for taxonomy tag and category values in the admin panel. Because taxonomy options are pooled globally, a malicious value on one page affects all page editor views. Additionally, the vulnerability leverages a bypass of Grav's 'Security::detectXss()' function, where the 'on_events' regex fails to identify unquoted event handlers. Attackers with editor-level privileges can inject payloads that break out of the HTML select context to execute JavaScript. The issue is resolved in Grav Form plugin 9.0.1 and Grav Core 2.0.0-beta.2.

Affected products

  • getgrav Grav CMS Form Plugin < 9.0.1
  • getgrav Grav CMS Core < 2.0.0-beta.2

Identifiers

  • CVE-2026-42842
  • GHSA-c2q3-p4jr-c55f

Timeline

  • 2026-04-24: patched: Fixes applied to Form plugin and Grav core branches.
  • 2026-05-05: advisory: GitHub Advisory published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.