CVE-2025-66309
MEDIUMGrav <1.11.0-beta.1 - XSS
Title source: llmDescription
This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /admin/pages/[page] endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[header][content][items] parameter. This vulnerability is fixed in 1.11.0-beta.1.
Scores
CVSS v3
6.1
EPSS
0.0006
EPSS Percentile
19.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (2)
getgrav/grav
0 - 1.8.0-beta.27Packagist
getgrav/grav-plugin-admin
< 1.10.50
Published
Dec 01, 2025
Tracked Since
Feb 18, 2026