CVE-2026-44737

MediumCVSS 6.2

Published: 11/05/2026(UTC)Updated: 26/10/2026(UTC)Translated: 26/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

25th percentile - higher than 25% of all known CVEs

Summary

grav-plugin-admin prior to 1.10.49.5 fails to properly validate and sanitize user input in the data[header][title] parameter. An attacker can craft a malicious URL with an XSS payload that is reflected in the HTTP response and executed in the victim's browser.

Risk Assessment

This may lead to execution of arbitrary JavaScript in the victim's session context, potentially data theft or account takeover.

Recommendation

Update grav-plugin-admin to version 1.10.49.5 or later.

Other vulnerabilities in grav-plugin-admin

CVE-2026-59190High
The grav-plugin-admin plugin in version 1.10.52 and earlier allows an authenticated attacker with admin.users permission to change the password of any user account, including the super administrator. The vulnerability exists because the saveUser function only checks general user-management permissions but does not verify whether the caller is authorized to edit the target user.

Original NVD description (English source)

grav-plugin-admin is the admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.10.49.5, the application fails to properly validate and sanitize user input in the data[header][title] parameter. As a result, attackers can craft a malicious URL with an XSS payload. When this URL is accessed, the injected script is reflected back in the HTTP response and executed within the context of the victim's browser session. This vulnerability is fixed in 1.10.49.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS