Grav-plugin-admin

This hub aggregates every CVE we track for Grav-plugin-admin, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 11 most recently published vulnerabilities affecting Grav-plugin-admin.

• CVE-2026-44737grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title]May 11, 2026
• CVE-2025-66312Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/accounts/groups/[group]` parameter `data[readableName]`5.4Dec 1, 2025
• CVE-2025-66311Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` in Multiples parameters5.4Dec 1, 2025
• CVE-2025-66310Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab5.4Dec 1, 2025
• CVE-2025-66309Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab6.1Dec 1, 2025
• CVE-2025-66308Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/config/site` parameter `data[taxonomies]`5.4Dec 1, 2025
• CVE-2025-66307Grav Admin Plugin vulnerable to User Enumeration & Email Disclosure6.5Dec 1, 2025
• CVE-2021-3920Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin5.4Nov 19, 2021
• CVE-2021-3799Improper Restriction of Rendered UI Layers or Frames in getgrav/grav-plugin-admin5.4Sep 27, 2021
• CVE-2021-29439Plugins can be installed with minimal admin privileges7.2Apr 13, 2021
• CVE-2021-21425Unauthenticated Arbitrary YAML Write/Update leads to Code Execution9.3Apr 7, 2021