CVE-2026-11982: Grav Grav-Plugin-API

Medium severity, CVSS 5.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Grav 2.0.0-rc.9 with Admin2 2.0.0-rc.14 contains a stored cross-site scripting (XSS) vulnerability in the Admin2 Pages API save flow.

Affected products

• Grav Grav-Plugin-API: version 1.7.52 only

Published 2026-06-18. Last modified 2026-06-22.