Medium severity · published Jun 18, 2026
CVE-2026-11982
Stored XSS via missing XSS safety check in Admin2 Pages API partial validation
5.1
CVSS
0.4%
EPSS
No
On KEV
Description
Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulnerability in the Admin2 Pages API save flow.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav-plugin-api · Grav
1.7.52 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-11982
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-11982
fluidattacks.com
https://fluidattacks.com/es/advisories/luis
github.com
https://github.com/getgrav/grav-plugin-api
github.com
https://github.com/getgrav/grav-plugin-api/commit/b8ca62eddb7dbea92075a78b1c0a507f03d66d4a
github.com
https://github.com/getgrav/grav/security/advisories/GHSA-5wc5-7v9g-f7v6