The grav-plugin-admin plugin for Grav fails to validate and sanitize user input supplied to the data[header][title] parameter on the /admin/pages/[page] endpoint. This allows an attacker to embed a malicious JavaScript payload in a crafted URL. When a victim visits that URL, the injected script is reflected in the HTTP response and executed within the victim's browser session, potentially enabling cookie theft, session hijacking, or other actions with the victim's privileges. The flaw is a stored/reflected cross-site scripting vulnerability classified as CWE‑79.

The vulnerability affects the Grav Admin Plugin (grav-plugin-admin) developed by the getgrav vendor. All versions prior to 1.10.49.5 are vulnerable; the issue was addressed in version 1.10.49.5 and later releases.

The CVSS base score is 6.2, which indicates moderate severity. EPSS data is currently unavailable, so the probability of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this XSS flaw by constructing a malicious URL that contains a JavaScript payload in the data[header][title] parameter and convincing a user with access to the Grav admin interface to visit the URL. Upon visiting, the script is reflected and executed in the context of the victim's browser, giving the attacker full access to the site’s session and any privileged actions the victim can perform.