CVE-2025-64059EPSS p20.6%

CVE-2025-64059CVE-2025-64059

Description

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content.

Scoring

CVSS 1.8 ()
VectorCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
EPSS0.30% probability of exploitation · percentile 20.6% · 2026-10-05T12:00:23Z
Last modified2026-09-16
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.