Grav Admin Plugin CVE-2025-66311

Requires an authenticated Grav Admin Panel account with page create/edit permission to inject the payload into the data[header][metadata], data[header][taxonomy][category], or data[header][taxonomy][tag] fields of the POST /admin/pages/[page] endpoint (PR:H). Execution additionally requires a privileged user to open or render the poisoned page in the administrative interface (UI:A/active interaction), so it is not exploitable against an unauthenticated remote attacker and depends on a second admin viewing the malicious page. Affects grav-plugin-admin versions prior to 1.11.0-beta.1.

This is a genuine but low-priority issue. The vendor CVSS 4.0 vector (6.2 Medium) requires PR:H (high privileges) and UI:A (active victim interaction), meaning the attacker must already hold an authenticated admin/editor account capable of creating or editing pages, and a second privileged user must then view the poisoned page in the Admin Panel. EPSS is very low at 0.04% (11th percentile), and there is no CISA KEV listing, so widespread or automated exploitation is not indicated. Publicly available exploit code exists (a working <script>alert()</script> PoC is published in the GHSA-mpjj-4688-3fxg advisory), but a PoC is not evidence of active exploitation. The signals are internally consistent: a stored XSS reachable only by authenticated content authors, with scope change (SC:H/SI:H/SA:H in 4.0) reflecting that the payload executes in another user's browser session. The primary real risk is privilege escalation within the admin team (a lower-privileged editor poisoning a page to hijack a full administrator's session), not mass exploitation.

An attacker with a low-privileged Grav admin account (e.g., an editor able to create/edit pages) injects a script payload such as <script>alert('PoC')</script> into a page's Metadata key, Taxonomy Category, or Tag field, which is saved into the page's YAML frontmatter. When a full administrator later opens or renders that page in the Admin Panel, the stored script executes in their authenticated session, enabling session/cookie theft or admin-account takeover. A working PoC is published in the GHSA advisory.