Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2025-66309

19
FAUCET Score

CVE-2025-66309 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the Grav admin plugin prior to version 1.11.0-beta.1. This flaw allows an attacker to inject malicious scripts into the data[header][content][items] parameter via the /admin/pages/[page] endpoint. Rated Medium severity (CVSS 6.1), it requires user interaction and could lead to limited data compromise and integrity issues. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
<= 1.10.50CPE matchmatch criteria
cpe:2.3:a:getgrav:grav-plugin-admin:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 4.0

6.2MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
HIGH
User Interaction
ACTIVE
VS Confidentiality
LOW
VS Integrity
LOW
VS Availability
NONE
SS Confidentiality
HIGH
SS Integrity
HIGH
SS Availability
HIGH
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.20%
Probability of exploitation in next 30 days
EPSS Percentile
10.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0020 is in the 10th percentile among its peer group of 26,221 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

composerpatch availablevia ghsa
Product: getgrav/gravFixed in: 1.8.0-beta.27
github_advisorypatch availablevia nvd_reference
View patch

Vendor Advisories (1)

composerGHSA-65mj-f7p4-wggqmedium

Grav is vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

Dec 2, 2025

References

github.com / getgrav/grav-plugin-admin/commit/99f653296504f1d6408510dd2f6f20a45a26f9b0
Patch
github.com / getgrav/grav/security/advisories/GHSA-65mj-f7p4-wggq
ExploitVendor Advisory