getgrav grav-plugin-admin vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Latest getgrav grav-plugin-admin vulnerabilities

CVE-2026-44737 — grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title] (CVSS 6.2)
CVE-2025-66312 — Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]` (CVSS 5.4)
CVE-2025-66311 — Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters (CVSS 5.4)
CVE-2025-66310 — Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab (CVSS 5.4)
CVE-2025-66309 — Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab (CVSS 6.1)
CVE-2025-66308 — Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]` (CVSS 5.4)
CVE-2025-66307 — Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure (CVSS 5.3)
CVE-2021-3920 — Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin (CVSS 5.4)
CVE-2021-3799 — Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin (CVSS 5.4)
CVE-2021-21425 — Unauthenticated Arbitrary YAML Write/Update leads to Code Execution (CVSS 9.8)