Stored Cross-Site Scripting Vulnerability in Grav by GetGrav

CVE-2026-64628

What is CVE-2026-64628?

Grav is susceptible to a stored cross-site scripting vulnerability due to inadequate validation in shortcode-core attribute handlers. In particular, the XSS detection only matches payloads with literal angle brackets, permitting attackers with admin.pages permission to inject harmful JavaScript through shortcode attributes. This malicious script executes in the browsers of all viewers, including administrators, which can lead to serious risks such as session hijacking through admin nonce theft. It's vital for users of affected versions to apply necessary patches to mitigate the risk.

References