Medium severity · published Jun 25, 2026
CVE-2020-37256
Grav - Cross-Site Scripting in Admin Plugin Page Editor
5.4
CVSS
0.3%
EPSS
No
On KEV
Description
Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
Grav · Grav
before 1.6.30 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37256
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37256
vendor-advisory
https://github.com/getgrav/grav/security/advisories/GHSA-cvmr-6428-87w9
third-party-advisory
https://www.vulncheck.com/advisories/grav-cross-site-scripting-in-admin-plugin-page-editor
More from Grav
9.8
CVE-2026-56700
Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection
6.5
CVE-2026-56701
Grav - XML External Entity Injection via SVG Upload
4.8
CVE-2026-58657
Grav - Stored CSS Injection via Markdown Image resize() Action
4.3
CVE-2026-58654
Grav - Arbitrary File Upload via Avatar Endpoint