CVE-2025-66843Medium· 5.4▾ Sunlitgrav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with permission to edit content can inject malicious JavaScript payloads into edit…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with permission to edit content can inject malicious JavaScript payloads into editable fields. The payload is stored on the server and later executed when any other user views or edits the affected page.
grav < 1.7.49.5Upgrade past the affected range:
grav 1.7.49.5Connected by shared product, vendor, weakness, or advisory.
CVE-2020-37256Medium· 5.4Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration
CVE-2026-61453Medium· 6.1Grav v2.0.0 contains a cross-site scripting vulnerability (fixed in 2.0.1)
CVE-2026-58657Medium· 4.8Grav before 2.0.0 (affected through 2.0.0-rc.9 and the 2.0 branch) contains a stored CSS injection vulnerability in the Markdown image resize() media action
CVE-2025-64059Low· 1.8Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor
CVE-2026-75834Medium· 5.4Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php)
CVE-2026-75107Medium· 5.4Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates