Stored Cross-Site Scripting Vulnerability in Grav Admin Plugin

CVE-2025-66312

What is CVE-2025-66312?

The Grav admin plugin, a vital interface for managing Grav applications, is susceptible to a Stored Cross-Site Scripting vulnerability. When unpatched versions are utilized, specifically before 1.11.0-beta.1, attackers can manipulate the /admin/accounts/groups/Grupo endpoint to inject harmful scripts into the data[readableName] parameter. Once embedded, these scripts are stored on the server and executed in user sessions, leading to severe security implications for site visitors. Immediate updates to the plugin are essential to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References