The grav-plugin-admin for Grav CMS improperly neutralizes input in the data[header][title] parameter, allowing reflected cross-site scripting (CWE-79). This occurs because user input is not properly validated or sanitized before being included in the HTML response. An attacker can exploit this by sending a crafted URL containing malicious script code that executes in the victim's browser session. The vulnerability affects all versions before 1.10.49.5 and is addressed by updating to 1.10.49.5.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session, potentially leading to session hijacking, defacement, or other client-side attacks. The CVSS 4.0 score of 6.2 reflects a medium impact with network attack vector, low complexity, and user interaction required. There are no known exploits in the wild at this time.

Upgrade grav-plugin-admin to version 1.10.49.5 or later, where this vulnerability is fixed. Since the vendor advisory confirms the fix in this version, applying this update fully mitigates the issue. No additional mitigations are indicated by the vendor.