CVE-2026-11982 is a stored cross-site scripting vulnerability in the Grav CMS grav-plugin-api component, specifically affecting version 1.7.52. The vulnerability arises from improper neutralization of input during the Admin2 Pages API save flow, which could allow an attacker with limited privileges and requiring user interaction to inject malicious scripts. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and low impact on confidentiality and integrity, with limited availability impact.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other malicious actions. However, the impact is limited by the requirement for low privileges and user interaction, and the overall severity is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with input handling in the Admin2 Pages API save flow and consider applying any available workarounds or temporary mitigations recommended by the vendor.