{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3agetgravdatamanager1.4.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:getgrav:datamanager:1.0.1:*:*:*:*:*:*:*","cpe:2.3:a:getgrav:datamanager:1.4.4:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-100673"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Grav Data Manager plugin (1.0.1-1.4.4)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","xss","cms-plugin"],"_cs_type":"advisory","_cs_vendors":["getgrav"],"content_html":"\u003cp\u003eThe Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 contain a stored cross-site scripting (XSS) vulnerability due to improper input sanitization. The vulnerability exists within the item-detail view (admin/templates/partials/item.html.twig), where user-supplied data is rendered using the Twig 'raw' filter without adequate escaping. Furthermore, the use of \u003ccode\u003estriptags('\u0026lt;br\u0026gt;')\u003c/code\u003e is insufficient as PHP's \u003ccode\u003estrip_tags()\u003c/code\u003e function can be bypassed, allowing attackers to inject malicious HTML and JavaScript payloads. An unauthenticated attacker can submit a crafted payload via a front-end form which is subsequently saved to the 'user/data' directory. When an administrator accesses the classic admin panel to view the submitted entry, the payload executes in the context of the administrator's session and origin, potentially exposing sensitive data or allowing unauthorized actions via the administrator's credentials and CSRF tokens. This issue is resolved in Data Manager version 1.4.5.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator viewing the data, leading to full account compromise or unauthorized administrative actions. This affects any site utilizing the vulnerable versions of the Data Manager plugin in the classic Grav admin interface, whereas installations using the Grav 2.0 Admin Next interface remain secure due to proper data escaping.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eUpdate the Grav Data Manager plugin to version 1.4.5 or later immediately. Given the nature of the vulnerability, review all existing data submissions in the 'user/data' directory for signs of malicious script injection, such as unexpected script tags or HTML attributes.\u003c/p\u003e\n","date_modified":"2026-09-26T15:10:15Z","date_published":"2026-09-26T15:10:15Z","id":"https://feed.craftedsignal.io/briefs/2026-09-grav-datamanager-xss/","summary":"An unauthenticated stored cross-site scripting vulnerability in the Grav Data Manager plugin allows attackers to execute malicious JavaScript in the context of an administrator's session.","title":"Stored XSS in Grav Data Manager Plugin (CVE-2026-100673)","url":"https://feed.craftedsignal.io/briefs/2026-09-grav-datamanager-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:getgrav:datamanager:1.4.4:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}