Grav Admin (plugin grav-plugin-admin2) versions prior to 2.0.21 are vulnerable to a stored cross‑site scripting flaw. The issue arises in the tHtml() function, which injects untrusted usernames into translation templates before parsing them as Markdown. Although Grav’s username validation blocks characters that could harm the filesystem, it allows the characters <, >, ", and '. An attacker can create a user account with an HTML payload in the username field. When an administrator opens certain UI screens—such as the two‑factor force‑disable confirmation prompt or the 'page is locked' editor notice—the payload is processed and executed within the administrator’s authenticated session. The vulnerability allows an attacker to run arbitrary JavaScript in the context of an administrator, potentially stealing session cookies, manipulating data, or defacing the interface.

All installations of Grav Admin (getgrav/grav-plugin-admin2) running version 2.0.19 or earlier are affected. The vulnerability also applies to any intermediate releases before the official fix in version 2.0.21. Administrators using older Grav core or plugin versions should verify that they are not running a vulnerable release.

The CVSS score of 5.1 indicates moderate severity. Because the flaw is a stored XSS that only requires the attacker to create a username, the risk is tied to the ability to add new users. Once an attacker succeeds, any administrator who views a UI surface processing the malicious username will be compromised. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is not yet widely observed but remains a legitimate risk if the software is kept unchanged.