Executive brief
The Grav Data Manager plugin, which stores form submissions from website visitors, fails to properly escape data when administrators review submissions in the classic admin panel. An unauthenticated attacker can submit a form containing malicious JavaScript that executes in an administrator's session when they view that submission, potentially allowing the attacker to steal sensitive data or perform unauthorized actions with the administrator's privileges.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in admin/templates/partials/item.html.twig that renders user-submitted data with Twig's raw filter without proper escaping. The plugin attempts to mitigate XSS by applying striptags('<br>') before rendering, but PHP's strip_tags() preserves allowed tags with their attributes intact, allowing event handlers to pass through. The payload executes automatically for list-type fields and on hover for text fields.
Affected products
- getgrav Grav Data Manager plugin 1.0.1 through 1.4.4
Timeline
- 2026-09-26: disclosed
- 2026-09-26: patched: Version 1.4.5 released