CVE-2025-64059NVD

Description

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content.

Severity Level

LOW (1.8)

Published Date

13/09/2026

Last Modified

13/09/2026

Exploitation Status

????

EPSS Score

0.23% (percentile 14.4%)

CVSS Base Metrics

CVSS v3 (3.1)

LOW 1.8

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-79

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.