CVE-2026-64628 PUBLISHED

Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers

Assigner: VulnCheck
Reserved: 20.07.2026 Published: 21.07.2026 Updated: 21.07.2026

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS Score: 5.1

Product Status

Vendor getgrav
Product grav
Versions Default: unaffected
  • affected from 0 to 6.2.1 (incl.)

Credits

  • YuvalMil reporter
  • LeonKaya reporter

References

Problem Types

  • Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE