Stored Cross-Site Scripting in Grav Admin Plugin

CVE-2025-66310

What is CVE-2025-66310?

A Stored Cross-Site Scripting vulnerability exists in the Grav Admin Plugin prior to version 1.11.0-beta.1, allowing malicious actors to inject harmful scripts via the data[header][template] parameter. The injected scripts are stored in the page's frontmatter and are executed whenever the compromised content is displayed, either in the administrative interface or the front end. This flaw could be exploited to execute unauthorized actions or extract sensitive information, highlighting the critical necessity for users to upgrade to the patched version.

References