The Grav Data Manager plugin (getgrav/grav-plugin-datamanager) versions 1.0.1 through 1.4.4 improperly neutralize input during web page generation by rendering stored data entries with Twig's `raw` filter after a PHP strip_tags('<br>') call that allows certain HTML tags and attributes to bypass filtering. An unauthenticated user can submit a front-end form with malicious HTML/JavaScript payloads saved to user data. When an administrator later views these entries in the classic admin panel (admin/templates/partials/item.html.twig), the payload executes with the administrator's privileges and CSRF token. Execution is automatic for list values and occurs on hover for text fields. The Grav 2.0 Admin Next interface is not affected due to a different, secure rendering method. The vulnerability is resolved in Data Manager version 1.4.5.

An unauthenticated attacker can inject and store malicious HTML/JavaScript that executes in the context of an administrator's session and privileges when the admin views the stored data in the classic admin panel. This can lead to unauthorized actions performed with the admin's credentials and CSRF token, potentially compromising the site integrity and security. The vulnerability does not require user interaction for some field types, increasing risk.

Upgrade the Grav Data Manager plugin to version 1.4.5 or later, where this vulnerability is fixed. Sites using the Grav 2.0 Admin Next interface are not affected by this issue. No other mitigations are indicated by the vendor advisory.