Is CVE-2026-44737 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44737 being exploited in the wild.

How severe is CVE-2026-44737?

Medium severity, with a CVSS score of 4, published 11 May 2026.

Which products and versions are affected?

Grav Admin Panel <= 1.10.49.4; Grav < 1.7.49.5; getgrav/grav (Packagist) < 1.7.49.5, ECOSYSTEM:introduced=0,fixed=1.7.49.5.

Is there a fix for CVE-2026-44737?

Yes. getgrav/grav (Packagist): upgrade to 1.7.49.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44737 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44737?

Check whether you run Grav Admin Panel, Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44737: Grav Admin Plugin stored XSS in page move dialog

Q: Which products and versions are affected?

Grav Admin Panel <= 1.10.49.4; Grav < 1.7.49.5; getgrav/grav (Packagist) < 1.7.49.5, ECOSYSTEM:introduced=0,fixed=1.7.49.5.

Q: Is there a fix for CVE-2026-44737?

Yes. getgrav/grav (Packagist): upgrade to 1.7.49.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44737 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-44737?

Check whether you run Grav Admin Panel, Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44737 · Severity: medium · CVSS 4 · Published 2026-05-11

Grav, a popular open-source content management system, contains a security flaw in its administration panel. An attacker with administrative privileges can inject malicious scripts into page titles, which then execute in the browsers of other administrators. This could lead to unauthorized actions being performed on behalf of users, sensitive data theft, or full account compromise.

Technologies: Grav, getgrav/grav (Packagist). Vendors: Grav, Packagist.

Quick answers

Is CVE-2026-44737 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44737 being exploited in the wild.
How severe is CVE-2026-44737?: Medium severity, with a CVSS score of 4, published 11 May 2026.
Which products and versions are affected?: Grav Admin Panel <= 1.10.49.4; Grav < 1.7.49.5; getgrav/grav (Packagist) < 1.7.49.5, ECOSYSTEM:introduced=0,fixed=1.7.49.5.
Is there a fix for CVE-2026-44737?: Yes. getgrav/grav (Packagist): upgrade to 1.7.49.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44737 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44737?: Check whether you run Grav Admin Panel, Grav or getgrav/grav (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

getgrav/grav (Packagist): upgrade to 1.7.49.5 or later
```
composer require getgrav/grav:^1.7.49.5
```

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Grav CMS admin panel within the `/admin/pages/[page]` endpoint. The root cause is a failure to properly sanitize user input in the `data[header][title]` parameter when saving or editing a page. An attacker with high privileges (admin access) can inject a JavaScript payload into the page title. This script is subsequently executed when another user interacts with the 'move' function or views the affected page folder in the admin interface. The vulnerability is patched in version 1.7.49.5.

Affected products

getgrav Grav < 1.7.49.5

Identifiers

CVE-2026-44737
GHSA-fmg2-f5r9-24qc

Timeline

2026-05-05: patched: Fix committed to getgrav/grav-plugin-admin
2026-05-08: disclosed: GitHub Advisory published
2026-05-11: advisory: NVD published CVE-2026-44737

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.