CVE-2026-42842

{
  "id": "CVE-2026-42842",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-11T17:16:33.873",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS Form plugin's select field template. Taxonomy tag and category values are rendered with the Twig |raw filter in the admin panel, bypassing the global autoescape protection. An editor-level user can inject arbitrary JavaScript that executes in any administrator's browser session when they view or edit any page in the admin panel. This vulnerability is fixed in 9.1.0."
    },
    {
      "lang": "es",
      "value": "El plugin de formularios para Grav añade la capacidad de crear y usar formularios. Antes de 9.1.0, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en la plantilla del campo de selección del plugin de formularios de Grav CMS. Los valores de etiquetas de taxonomía y categoría se renderizan con el filtro Twig |raw en el panel de administración, omitiendo la protección global de autoescape. Un usuario con nivel de editor puede inyectar JavaScript arbitrario que se ejecuta en la sesión del navegador de cualquier administrador cuando ven o editan cualquier página en el panel de administración. Esta vulnerabilidad está corregida en 9.1.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "getgrav",
          "product": "grav",
          "versions": [
            {
              "version": "< 2.0.0-beta.2",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "getgrav",
          "product": "grav-plugin-form",
          "versions": [
            {
              "version": "< 9.1.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-11T18:24:43.410950Z",
          "id": "CVE-2026-42842",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/getgrav/grav-plugin-form/commit/6bffb4c98be468a155d1656544ec45bb4a443957",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-c2q3-p4jr-c55f",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}