CVE-2020-37256: Grav - Cross-Site Scripting in Admin Plugin Page Editor

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-25 · updated 2026-10-08
Weakness: CWE-79

Description

Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access.

Affected products

getgrav grav: before 1.6.30 — fixed in 1.6.30

How to fix

Upgrade to a fixed version: getgrav grav 1.6.30. Check the vendor advisory for mitigations.

References

https://github.com/getgrav/grav/security/advisories/GHSA-cvmr-6428-87w9
https://www.vulncheck.com/advisories/grav-cross-site-scripting-in-admin-plugin-page-editor

Get alerted when CVE-2020-37256 or the next vulnerability affects your stack