The Grav CMS Form plugin before version 9.1.0 contains a stored XSS vulnerability (CWE-79) in its select field template. This vulnerability arises because taxonomy tag and category values are output using the Twig |raw filter in the admin panel, which disables automatic escaping of potentially malicious input. An attacker with editor-level privileges can inject JavaScript code that will execute in the browsers of administrators who view or edit any page in the admin interface. This vulnerability allows for cross-site scripting attacks that can compromise administrator sessions or perform unauthorized actions within the admin panel. The issue is resolved in Grav CMS Form plugin version 9.1.0.

Successful exploitation allows an attacker with editor-level access to inject and store malicious JavaScript code that executes in the context of administrator users' browsers. This can lead to session hijacking, unauthorized actions, or other client-side attacks within the admin panel. The vulnerability does not affect availability and requires user interaction (administrator viewing or editing pages). The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges at editor level, user interaction needed, and partial confidentiality and integrity impact.

Upgrade the Grav CMS Form plugin to version 9.1.0 or later, where this vulnerability is fixed. There is no official patch or temporary fix indicated other than upgrading. Until upgraded, restrict editor-level access to trusted users only and monitor for suspicious activity in the admin panel. Patch status is not explicitly stated beyond the fix in version 9.1.0, so verify with the vendor advisory for the latest remediation guidance.