CVE-2025-66308 MEDIUM

CVE-2025-66308: Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`

Vendor Getgrav
Product grav
Weakness CWE-79 · XSS
Published December 1, 2025
Last update December 2, 2025
View on NVD All CVEs

CVSS base score

6.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

What the vulnerability does

01Description

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/config/site endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[taxonomies] parameter. The injected payload is stored on the server and automatically executed in the browser of any user who accesses the affected site configuration, resulting in a persistent attack vector. This vulnerability is fixed in 1.11.0-beta.1.

Key dates

02Disclosure timeline

December 1, 2025 CVE published
December 2, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-0903 User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.0.13 - Unauthenticated Stored Cross-Site Scripting CVE-2024-13542 WP Google Street View (with 360° virtual tour) & Google maps + Local SEO <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-34399 MailEnable < 10.54 Reflected XSS in AddressesCc Parameter of AddressBook.aspx CVE-2024-4860 CVE-2024-5221 Qi Blocks <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting