CVE-2026-85600

Name of the Vulnerable Software and Affected Versions Grav Admin (getgrav/grav-plugin-admin2) versions prior to 2.0.21

Description A stored cross-site scripting issue exists in the tHtml() function (src/lib/stores/i18n.svelte.ts), which inserts untrusted parameters like usernames into translation templates before parsing them as markdown. Because the server-side validation function isValidUsername() does not block characters such as <, >, ", or ', an attacker can register a username containing an HTML payload. This payload executes in the authenticated session of an administrator when they view UI elements that render the username via tHtml(), such as the 'page is locked' editor notice or the two-factor force-disable confirmation prompt.

Recommendations Update Grav Admin (getgrav/grav-plugin-admin2) to version 2.0.21.