CVE-2025-66308

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the /admin/config/site endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the data[taxonomies] parameter. The injected payload is stored on the server and automatically executed in the browser of any user who accesses the affected site configuration, resulting in a persistent attack vector. This vulnerability is fixed in 1.11.0-beta.1.

• CWE-79

• https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0Patch
• https://github.com/getgrav/grav/security/advisories/GHSA-gqxx-248x-g29fExploit, Vendor Advisory
• https://github.com/getgrav/grav/security/advisories/GHSA-gqxx-248x-g29fExploit, Vendor Advisory

Published

Dec 1, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-66302Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A…6.8
• CVE-2025-66303Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A…4.9
• CVE-2025-66304Grav is a file-based Web platform. Prior to 1.8.0-beta.27, u…7.2
• CVE-2025-66305Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a…4.9
• CVE-2025-66306Grav is a file-based Web platform. Prior to 1.8.0-beta.27, t…6.5
• CVE-2025-66307This admin plugin for Grav is an HTML user interface that pr…5.3
• CVE-2025-66309This admin plugin for Grav is an HTML user interface that pr…6.1
• CVE-2025-6631A maliciously crafted PRT file, when parsed through certain …7.8
• CVE-2025-66310This admin plugin for Grav is an HTML user interface that pr…5.4
• CVE-2025-66311This admin plugin for Grav is an HTML user interface that pr…5.4
• CVE-2025-66312This admin plugin for Grav is an HTML user interface that pr…5.4
• CVE-2025-66313ChurchCRM is an open-source church management system. In Chu…7.2