CVE-2026-64628

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.

CVSS 4.0

5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-25)

CWE

CWE-79

Published

2026-07-21

Modified

2026-10-24

Record from

the NVD, synced 2026-10-25

References

• https://github.com/getgrav/grav/security/advisories/GHSA-q5fw-vpqc-fgph
• https://www.vulncheck.com/advisories/grav-stored-cross-site-scripting-via-shortcode-attribute-handlers
• https://github.com/getgrav/grav/security/advisories/GHSA-q5fw-vpqc-fgph

Check your stackJSON