CVE-2026-64628 — Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers
Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle bracke…
Published: 2026-07-21 · CVSS: 5.1 · CVSS 4.0
Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7