Vulnerabilities in getgrav
211 resultsCVE-2026-72696HIGHGrav CMS before 2.0.16 Symlink Following via createLockFileEPSS 0.2%CVE-2026-109319MEDIUMGrav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in ModerationEPSS 0.2%CVE-2026-109322MEDIUMGrav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin ViewsEPSS 0.2%CVE-2026-61453MEDIUMGrav before 2.0.1 XSS via Twig String ConcatenationEPSS 0.2%CVE-2026-64628MEDIUMGrav Stored Cross-Site Scripting via Shortcode Attribute HandlersEPSS 0.2%CVE-2026-42842MEDIUMgrav-plugin-form: XSS via Taxonomy Field Values in Admin PanelEPSS 0.2%CVE-2026-62671MEDIUMCSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secret (no nonce on task=login.regenerate2FASecret)EPSS 0.2%CVE-2026-61456MEDIUMGrav before 1.0.3 Stored XSS via SVG Upload APIEPSS 0.2%CVE-2026-72702CRITICALGrav CMS before 2.0.16 Origin Validation Bypass via RefererEPSS 0.1%CVE-2025-64059LOWGrav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admEPSS 0.1%CVE-2026-62236LOWgrav-plugin-login < 3.8.11 CSRF via regenerate2FASecretEPSS 0.1%