Unrated severityNVD Advisory· Published Jun 25, 2026· Updated Jun 27, 2026
Grav - Cross-Site Scripting in Admin Plugin Page Editor
CVE-2020-37256
Description
Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access.
Affected products
2- Range: <1.6.30
Patches
Vulnerability mechanics
References
2- github.com/getgrav/grav/security/advisories/GHSA-cvmr-6428-87w9mitrevendor-advisory
- www.vulncheck.com/advisories/grav-cross-site-scripting-in-admin-plugin-page-editormitrethird-party-advisory
News mentions
0No linked articles in our index yet.