PT-2026-39296 · Grav · Grav Admin Plugin

Vdh1612 · Published 2026-05-08 · Updated 2026-05-11 · CVE-2026-44737

Positive Technologies (AI Summary)

CVSS v4.0

6.2

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions grav-plugin-admin versions prior to 1.10.49.5

Description The application fails to properly validate and sanitize user input in the data[header][title] parameter. This allows attackers to craft a malicious URL containing a Cross-Site Scripting (XSS) payload. When accessed, the injected script is reflected in the HTTP response and executed within the victim's browser session. This issue affects the '/admin/pages/[page]' endpoint.

Recommendations Update to version 1.10.49.5.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-44737

GHSA-FMG2-F5R9-24QC

Affected Products

Grav Admin Plugin

References · 6

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-fmg2-f5r9-24qc · Exploit
• https://osv.dev/vulnerability/GHSA-fmg2-f5r9-24qc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44737 · Security Note
• https://github.com/getgrav/grav · Note
• https://github.com/getgrav/grav-plugin-admin/commit/f67cc18e81d8767bb43d29ee6422c55ed0427803 · Note
• https://twitter.com/CVEnew/status/2053932460472496240 · Twitter Post