CVE-2026-72821 is a stored XSS in the Grav Form plugin affecting radio and toggle field option labels. The vulnerability allows any user with form authoring permissions to inject JavaScript through option label fields that render without sanitization when the |raw filter is applied. The attack executes in the browser of administrators viewing form configurations, enabling session hijacking and lateral movement.
The permission model is the first thing to scrutinize. "Form authoring permissions" sounds restrictive but typically includes content editors, marketing users, and other non-admin roles who legitimately need to build forms. Compromised accounts at this privilege level, social engineering, or cross-site scripting chains from lower-severity vulnerabilities can all reach this execution point. The security boundary between "can edit content" and "can execute code in admin sessions" has effectively collapsed — this isn't a 5.4-medium problem, it's a credential compromise vector that CVSS underweights.
Beyond this specific instance, audit every other field in the Form plugin that renders user-controlled data. Option labels in radio and toggle fields aren't a legitimate rich-text use case — they're structured metadata that should never contain HTML. The fix isn't teaching developers to reach for sanitizers; it's treating form field option labels as a separate rendering context with HTML stripped by default. The blast radius collapses when you stop treating form metadata as if it has the same rendering requirements as form body content.
The deeper problem is architectural. Grav's plugin architecture creates tight coupling between plugins and theme template overrides. Patching |raw out of the Form plugin's rendering can break legitimate rendering in themes that override those templates. This coupling creates different selection pressure than isolated module ecosystems face — security patches can regress security elsewhere, making developers hesitant to apply aggressive sanitization. The real fix requires rethinking how Grav plugins establish rendering boundaries so that security patches in one plugin don't create risk in others.
Track where |raw appears in your codebase. Every commit introducing this filter on user-controlled rendering paths should be flagged in code review. The pattern recurs across ecosystems — Twig, Blade, Drupal, WordPress — because the template engine makes the insecure path the path of least resistance. The goal isn't just patching this instance but reducing the attack surface in sibling rendering paths that share the same forgotten architectural choice.