# CVE-2026-100673: Grav Data Manager stored XSS in item-detail view

Source: https://junglewise.ai/threats/cve-2026-100673-the-grav-data-manager-plugin-getgrav-grav-plugin-datamanager  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-100673 · Severity: high · CVSS 8.2 · Published 2026-09-26

The Grav Data Manager plugin, which stores form submissions from website visitors, fails to properly escape data when administrators review submissions in the classic admin panel. An unauthenticated attacker can submit a form containing malicious JavaScript that executes in an administrator's session when they view that submission, potentially allowing the attacker to steal sensitive data or perform unauthorized actions with the administrator's privileges.

Vendors: [Getgrav](https://junglewise.ai/threats/vendors/getgrav).

## Quick answers

**Is CVE-2026-100673 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-100673 being exploited in the wild.

**How severe is CVE-2026-100673?** High severity, with a CVSS score of 8.2, published 26 September 2026.

**Which products and versions are affected?** Getgrav Grav Data Manager plugin 1.0.1 through 1.4.4.

**Is there a fix for CVE-2026-100673?** A patch was published on 2026-09-26: Version 1.4.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-100673 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-100673?** Check whether you run Getgrav Grav Data Manager plugin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in admin/templates/partials/item.html.twig that renders user-submitted data with Twig's raw filter without proper escaping. The plugin attempts to mitigate XSS by applying striptags('<br>') before rendering, but PHP's strip_tags() preserves allowed tags with their attributes intact, allowing event handlers to pass through. The payload executes automatically for list-type fields and on hover for text fields.

## Affected products

- getgrav Grav Data Manager plugin 1.0.1 through 1.4.4

## Timeline

- 2026-09-26: disclosed
- 2026-09-26: patched: Version 1.4.5 released

## References

- [https://github.com/getgrav/grav/security/advisories/GHSA-863q-9v8v-m9fv](https://github.com/getgrav/grav/security/advisories/GHSA-863q-9v8v-m9fv)
- [https://www.vulncheck.com/advisories/grav-data-manager-before-1.4.5-stored-xss-via-item-detail-view](https://www.vulncheck.com/advisories/grav-data-manager-before-1.4.5-stored-xss-via-item-detail-view)