← CVE Intelligence

CVE-2026-11982

Stored XSS via missing XSS safety check in Admin2 Pages API partial validation PUBLISHED

Description (CNA)

Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulnerability in the Admin2 Pages API save flow.

Affected (CNA)

Vendor / product	Versions
Grav / grav-plugin-api	affected 1.7.52

CWE

CWE-79

References

ADP enrichment

CISA-ADP

No English description supplied.

https://github.com/getgrav/grav/security/advisories/GHSA-5wc5-7v9g-f7v6