Grav Data Manager plugin renders stored entries in the item‑detail view through Twig’s raw filter after an ineffective strip_tags() call, allowing an unauthenticated visitor to submit a front‑end form that stores malicious HTML. When an administrator later opens that entry in the classic admin panel, the embedded JavaScript executes with the administrator’s privileges and CSRF token, providing the attacker the ability to run code in an elevated context without further interaction. The flaw triggers automatically for list values on load and for text fields on hover, making stored XSS a persistent threat.

Versions 1.0.1 to 1.4.4 of the Grav Data Manager plugin are affected. Grav 2.0 Admin Next is not impacted because it renders data through a separate, properly escaped path. The issue was fixed in Data Manager 1.4.5; any instance using that or later versions is safe.

The CVSS score of 8.4 indicates high severity. An attacker can exploit the flaw by simply posting a malicious form entry from any browser; no authentication is required to create the payload. Once an administrator views the entry, the code runs automatically, giving the attacker an elevated position. Although the EPSS score is not available, the lack of a barrier to exploitation keeps the risk high, and the vulnerability is not yet listed in the CISA KEV catalog.