CVE Feed

    Dashboard / CVE / CVE-2025-66308

    CVE-2025-66308

    This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/config/site endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[taxonomies] parameter. The injected payload is stored on the server and automatically executed in the browser of any user who accesses the affected site configuration, resulting in a persistent attack vector. This vulnerability is fixed in 1.11.0-beta.1.

    Published:Dec 1, 2025
    Last Modified:Dec 3, 2025
    EPS:Dec 1, 2025
    EPSS Score:0.00043
    CVSS Score:5.4

    Affected Products

    Vendor
    Getgrav
    Product
    Grav
    Vendor
    Getgrav
    Product
    Grav-plugin-admin

    Exploits

    https://github.com/getgrav/grav/security/advisories/GHSA-gqxx-248x-g29fhttps://github.com/getgrav/grav/security/advisories/GHSA-gqxx-248x-g29f

    Related CVEs

    CVE-2026-86197 (CVSS 5.1) — Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists ad…
    CVE-2026-86196 (CVSS 8.7) — Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot…
    CVE-2026-86195 (CVSS 8.7) — grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsControll…
    CVE-2026-86194 (CVSS 6.9) — Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, a…
    CVE-2026-86193 (CVSS 8.7) — grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, a…
    CVE-2026-85604 (CVSS 8.7) — Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig so…
    CVE-2026-85603 (CVSS 7.1) — Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that …
    CVE-2026-85602 (CVSS 9.3) — The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to …
    CVE-2026-85601 (CVSS 5.1) — Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Sve…
    CVE-2026-85600 (CVSS 5.1) — Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High