Grav CMS version 1.6.30 with Admin plugin version 1.9.18 suffers from a persistent cross site scripting vulnerability.