CVE-2026-64628

Name of the Vulnerable Software and Affected Versions Grav (affected versions not specified)

Description Stored cross-site scripting exists in the shortcode-core attribute handlers. The XSS detection scan only identifies payloads containing literal angle brackets, which allows shortcode parameters to bypass validation. Users with admin.pages permission can inject malicious JavaScript through shortcode attributes. This script executes in the browser of any user viewing the page, including administrators, potentially leading to session hijacking through the theft of admin nonces (unique tokens used to prevent replay attacks).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.