Leonkaya

Stored cross-site scripting exists in the shortcode-core attribute handlers. The XSS detection scan only identifies payloads containing literal angle brackets, which allows shortcode parameters to bypass validation. Users with `admin.pages` permission can inject malicious JavaScript through shortcode attributes. This script executes in the browser of any user viewing the page, including administrators, potentially leading to session hijacking through the theft of admin nonces (unique tokens used to prevent replay attacks).

The plugin fails to properly authorize API key generation and revocation. It intercepts the `apiKeyGenerate` and `apiKeyRevoke` admin tasks before the account-management Access Control List (ACL) runs, authorizing the caller based only on the `admin.login` permission, which is the baseline permission for every panel user. This allows any user with `admin.login` to create a persistent API key bound to any account. The forged key inherits the API permissions of the target account, potentially leading to account impersonation and privilege escalation up to full account takeover if the target account has broader permissions.

Remote code execution is possible through the `Blueprint::dynamicData()` function in the `system/src/Grav/Common/Data/Blueprint.php` file. The issue occurs because a `Class::method` callable string and its arguments are passed directly to `call user func array()` without an allowlist. An authenticated user with `admin.pages` or `api.pages.write` permissions can insert a malicious callable directive into a page via the form plugin. This command then executes as the web-server user when any user, including unauthenticated visitors, accesses the affected page.