CVE-2026-44737— grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title]
Possible ATT&CK Techniques 1AI
T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| getgrav | grav-plugin-admin | < 1.10.49.5 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44737
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
grav-plugin-admin: Stored Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][title]
Source: NVD (National Vulnerability Database)
Vulnerability Description
grav-plugin-admin is the admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.10.49.5, the application fails to properly validate and sanitize user input in the data[header][title] parameter. As a result, attackers can craft a malicious URL with an XSS payload. When this URL is accessed, the injected script is reflected back in the HTTP response and executed within the context of the victim's browser session. This vulnerability is fixed in 1.10.49.5.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Grav-Plugin-Admin 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Grav-Plugin-Admin是Grav开源的一个管理插件。用于配置Grave页面。 Grav-Plugin-Admin 1.10.49.5之前版本存在跨站脚本漏洞，该漏洞源于对data[header][title]参数验证和清理不当，可能导致反射型跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| getgrav | grav-plugin-admin | < 1.10.49.5 | - |
II. Public POCs for CVE-2026-44737
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44737
请登录查看更多情报信息。
- https://github.com/getgrav/grav/security/advisories/GHSA-fmg2-f5r9-24qcx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-44737
Same Patch Batch · getgrav · 2026-05-11 · 13 CVEs total
| CVE-2026-42613 | 9.4 CRITICAL | Grav: Privilege Escalation via Missing Server-Side Validation of groups/access |
| CVE-2026-42607 | 9.1 CRITICAL | Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Featur |
| CVE-2026-42611 | 8.9 HIGH | Grav: Stored XSS via Tag Injection |
| CVE-2026-42843 | 8.8 HIGH | grav-plugin-api: Grav API Privilege Escalation to Super Admin |
| CVE-2026-42612 | 8.5 HIGH | Grav: Publisher-Level Stored XSS via Unquoted Event Attributes |
| CVE-2026-42609 | 8.1 HIGH | Grav: Administrative Account Disruption and Privilege De-escalation via User Overwrite Log |
| CVE-2026-44738 | 7.7 HIGH | Grav: Twig sandbox allows editor-role users to exfiltrate all plugin secrets via Config::t |
| CVE-2026-42610 | 6.5 MEDIUM | Grav: Sensitive Information Disclosure via Accounts Service Bypass |
| CVE-2026-42842 | 5.4 MEDIUM | grav-plugin-form: XSS via Taxonomy Field Values in Admin Panel |
| CVE-2026-42608 | Grav: Unauthenticated Path Traversal & Arbitrary File Write in FormFlash component. | |
| CVE-2026-42845 | Grav: Anonymous Page Content Overwrite via Form File Upload filename Override | |
| CVE-2026-42841 | Grav: Stored XSS via Markdown media attribute() action in Grav CMS |
IV. Related Vulnerabilities
Same vendor: getgrav
- CVE-2026-42844
Grav: Low-privileged API users can create super-admin accoun - CVE-2026-42843
grav-plugin-api: Grav API Privilege Escalation to Super Admi - CVE-2026-44738
Grav: Twig sandbox allows editor-role users to exfiltrate al - CVE-2026-42845
Grav: Anonymous Page Content Overwrite via Form File Upload - CVE-2026-42842
grav-plugin-form: XSS via Taxonomy Field Values in Admin Pan
Same weakness: CWE-79
- CVE-2026-7498
Stored XSS in Basamak Informatics' DernekWeb - CVE-2026-3495
Unescaped variables during error page composition - CVE-2018-25331
Zenar Content Management System Cross-Site Scripting via aja - CVE-2021-47981
Quick.CMS 6.7 Cross-Site Scripting via CSRF to Sliders Form - CVE-2021-47975
WordPress Plugin WP Learn Manager 1.1.2 Stored XSS
V. Comments for CVE-2026-44737
No comments yet