Getgrav Grav-plugin-admin vulnerabilities

• getgrav grav-plugin-admin2 Grav Admin before 2.0.21 Stored XSS via username CVE-2026-85600 5.1 MediumSeptember 4, 2026
• getgrav grav-plugin-admin grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title] CVE-2026-44737 Fix available 6.2 MediumMay 8, 2026
• getgrav grav, grav-plugin-admin +1 more Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]` CVE-2025-66312 Fix available 6.2 MediumDecember 1, 2025
• getgrav grav, grav-plugin-admin +1 more Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters CVE-2025-66311 Fix available 6.2 MediumDecember 1, 2025
• getgrav grav, grav-plugin-admin +1 more Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab CVE-2025-66310 Fix available 6.2 MediumDecember 1, 2025
• getgrav grav, grav-plugin-admin +1 more Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab CVE-2025-66309 Fix available 6.2 MediumDecember 1, 2025
• getgrav grav, grav-plugin-admin +1 more Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]` CVE-2025-66308 Fix available 6.8 MediumDecember 1, 2025
• getgrav grav, grav-plugin-admin +1 more Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure CVE-2025-66307 Fix available 6.5 MediumDecember 1, 2025
• getgrav getgrav/grav-plugin-admin, grav-plugin-admin +1 more Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin CVE-2021-3920 4.6 MediumNovember 19, 2021
• getgrav getgrav/grav-plugin-admin, grav-plugin-admin +1 more Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin CVE-2021-3799 5.4 MediumSeptember 27, 2021
• getgrav grav admin, grav-plugin-admin +1 more Plugins can be installed with minimal admin privileges CVE-2021-29439 7.2 HighApril 13, 2021
• getgrav grav-plugin-admin Unauthenticated Arbitrary YAML Write/Update leads to Code Execution CVE-2021-21425 Public exploit EPSS 80.6% 9.3 CriticalApril 7, 2021