CVE-2026-72821 is a stored cross-site scripting vulnerability affecting the Grav Form plugin prior to version 9.1.15. The vulnerability arises from improper neutralization of input in radio and toggle field option labels, which are rendered with the Twig |raw filter. This allows attackers who have form authoring permissions to inject arbitrary HTML and JavaScript payloads. When other users or administrators view the affected forms, the injected scripts execute in their browsers, potentially leading to session hijacking or other client-side attacks. The vulnerability requires at least limited privileges (form authoring) to exploit and has a CVSS 4.0 base score of 5.1, indicating medium severity.

Successful exploitation allows an attacker with form authoring permissions to inject and store malicious scripts in form option labels. These scripts execute in the browsers of visitors and administrators viewing the form, which can lead to client-side attacks such as session hijacking or unauthorized actions performed in the context of the victim's session. The vulnerability does not require user interaction beyond viewing the form and has low attack complexity and privileges required.

No official patch or remediation level has been confirmed as of the publication date. Users should upgrade to Grav Form plugin version 9.1.15 or later once available, as the vulnerability affects versions before 9.1.15. Until a patch is applied, restrict form authoring permissions to trusted users only to reduce the risk of exploitation. Monitor vendor advisories for updates on official fixes.