getgrav grav-plugin-admin vulnerabilities

Latest getgrav grav-plugin-admin CVEs

Newest publication first

1. CVE-2026-44737 grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title]

   Published 2026-05-11

   Medium·CVSS 6.2 EPSS 0.32%

   grav-plugin-admin is the admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.10.49.5, the application fails to properly validate and sanitize user input in the data[header][title] paramete...

2. CVE-2025-66312 Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`

   Published 2025-12-01

   Medium·CVSS 6.2 EPSS 0.23%

   This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/accounts/groups/Grupo endpoint of the G...

3. CVE-2025-66311 Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters

   Published 2025-12-01

   Medium·CVSS 6.2 EPSS 0.23%

   This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav appli...

4. CVE-2025-66310 Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab

   Published 2025-12-01

   Medium·CVSS 6.2 EPSS 0.23%

   This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav appli...

5. CVE-2025-66309 Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

   Published 2025-12-01

   Medium·CVSS 6.2 EPSS 0.25%

   This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav ap...

6. CVE-2025-66308 Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`

   Published 2025-12-01

   Medium·CVSS 6.8 EPSS 0.23%

   This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/config/site endpoint of the Grav applic...

7. CVE-2025-66307 Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure

   Published 2025-12-01

   Medium·CVSS 5.3 EPSS 0.34%

   This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a user enumeration and email disclosure vulnerability exists in Grav. The "Forgot Password" functionality at /admin/fo...

8. CVE-2021-3920 Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin

   Published 2021-11-19

   Medium·CVSS 5.4 EPSS 1.4%

   grav-plugin-admin is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

9. CVE-2021-3799 Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin

   Published 2021-09-27

   Medium·CVSS 5.4 EPSS 1.6%

   grav-plugin-admin is vulnerable to Improper Restriction of Rendered UI Layers or Frames

10. CVE-2021-29439 Plugins can be installed with minimal admin privileges

    Published 2021-04-13

    High·CVSS 7.2 EPSS 2.6%

    The Grav admin plugin prior to version 1.10.11 does not correctly verify caller's privileges. As a consequence, users with the permission admin.login can install third-party plugins and their dependencies. By installing the right plugin, an attacker can obtain an arbitrary code e...

11. CVE-2021-21425 Unauthenticated Arbitrary YAML Write/Update leads to Code Execution

    Published 2021-04-07

    Critical·CVSS 9.8 EPSS 80.6% Framework module Public exploit

    Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.