CVE-2025-66310

Grav’s admin plugin suffers a Stored XSS in the /admin/pages/[page] endpoint via data[header][template] stored in page frontmatter. Impact is execution of scripts when rendering content in admin or frontend views. Fix available in Grav 1.11.0-beta.1. No exploitation details are provided beyond th...