The Grav Form Plugin versions prior to 9.1.19 do not escape field-definition properties such as prepend, append, spacer text, section text, and select option labels in form templates. This improper neutralization of input during web page generation allows attackers who have form authoring privileges to inject arbitrary HTML and JavaScript code. The vulnerability is due to unescaped |raw filters and unquoted attributes in the form templates, leading to cross-site scripting (XSS) attacks that execute in the context of form visitors.

An attacker with form authoring privileges can inject malicious scripts that execute in the browsers of users visiting the affected forms. This can lead to theft of user data, session hijacking, or other client-side attacks. The vulnerability requires the attacker to have privileges to create or modify forms, limiting the attack surface. The CVSS 4.0 base score is 5.1, indicating medium severity.

No official patch or remediation level is currently confirmed. Users should upgrade to Grav Form Plugin version 9.1.19 or later once available, as the vulnerability affects versions before 9.1.19. Until a fix is applied, restrict form authoring privileges to trusted users only to reduce risk. Monitor vendor advisories for official patches or updates.