What is GHSA-gwrh-r2g6-7wgp?

GHSA-gwrh-r2g6-7wgp is a security advisory published by GitHub Security Advisories with Medium severity. Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor...

Which CVE IDs does GHSA-gwrh-r2g6-7wgp cover?

GHSA-gwrh-r2g6-7wgp covers the following CVE IDs: CVE-2020-37256. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gwrh-r2g6-7wgp?

GHSA-gwrh-r2g6-7wgp has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-gwrh-r2g6-7wgpMediumCVSS 5.4

Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor...

Vendor

GitHub Security Advisories

Published

June 26, 2026

Last Modified

June 26, 2026

🔗 CVE IDs covered (1)

CVE-2020-37256 →

📋 Description

Grav before 1.6.30 contains a cross-site scripting vulnerability in the Admin plugin page editor default security configuration. Privileged users with page editing capabilities can inject malicious scripts to execute arbitrary code and install malicious plugins for system access.

🔗 References (4)

https://github.com/getgrav/grav/security/advisories/GHSA-cvmr-6428-87w9
https://nvd.nist.gov/vuln/detail/CVE-2020-37256
https://www.vulncheck.com/advisories/grav-cross-site-scripting-in-admin-plugin-page-editor
https://github.com/advisories/GHSA-gwrh-r2g6-7wgp