CVE-2025-66310 – A stored XSS vulnerability in Grav's admin plug... (How to Fix)

Q: What is the severity of CVE-2025-66310?

CVE-2025-66310 has a CVSS score of 5.4 (MEDIUM). A stored XSS vulnerability in Grav's admin plugin allows attackers to inject malicious scripts into page templates. These scripts execute automatically when affected content is viewed in the admin interface or frontend. All Grav installations using the admin plugin before version 1.11.0-beta.1 are affected.

📋 TL;DR

A stored XSS vulnerability in Grav's admin plugin allows attackers to inject malicious scripts into page templates. These scripts execute automatically when affected content is viewed in the admin interface or frontend. All Grav installations using the admin plugin before version 1.11.0-beta.1 are affected.

💻 Affected Systems

Products:

Grav CMS
Grav Admin Plugin

Versions: All versions before 1.11.0-beta.1

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Requires admin plugin enabled and admin access to exploit.

📦 What is this software?

Grav Plugin Admin by Getgrav

View all CVEs affecting Grav Plugin Admin →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could steal admin session cookies, perform actions as administrators, deface websites, or redirect users to malicious sites.

🟠

Likely Case

Session hijacking of admin users leading to unauthorized content modification or data theft.

🟢

If Mitigated

Limited impact with proper input validation and output encoding in place.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploitation requires admin access to inject payload via template parameter.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.11.0-beta.1

Vendor Advisory: https://github.com/getgrav/grav/security/advisories/GHSA-7g78-5g5g-mvfj

Restart Required: No

Instructions:

1. Update Grav admin plugin to version 1.11.0-beta.1 or later. 2. Run 'bin/gpm update' from Grav root directory. 3. Clear Grav cache if needed.

🔧 Temporary Workarounds

Input Validation Filter

all

Add custom validation to sanitize template parameter inputs

Implement custom validation in user/plugins/admin/admin.php

🧯 If You Can't Patch

Restrict admin access to trusted users only
Implement WAF rules to block XSS payloads in template parameters

🔍 How to Verify

Check if Vulnerable:

Check admin plugin version in user/plugins/admin/admin.php or via Grav admin panel

Check Version:

php bin/gpm version | grep admin

Verify Fix Applied:

Verify admin plugin version is 1.11.0-beta.1 or higher

📡 Detection & Monitoring

Log Indicators:

Unusual template parameter values in page edit logs
Multiple failed admin login attempts

Network Indicators:

Suspicious JavaScript payloads in HTTP POST to /admin/pages/ endpoints

SIEM Query:

source="grav_logs" AND ("data[header][template]" CONTAINS "<script>" OR "javascript:")

📊 Metadata

CVE ID: CVE-2025-66310

CVSS v3 Score: 5.4 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE: CWE-79

EPSS Score: 0.04% exploit probability (10.8th percentile)

Published: December 1, 2025

Last Updated: December 3, 2025

🔗 References

https://github.com/getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0 Patch
https://github.com/getgrav/grav/security/advisories/GHSA-7g78-5g5g-mvfj Exploit,Vendor Advisory
https://github.com/getgrav/grav/security/advisories/GHSA-7g78-5g5g-mvfj Exploit,Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-66310, you might also want to check these: