CVE-2026-64628: Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-21 · updated 2026-10-24
Weakness: CWE-79

Description

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.

Affected products

getgrav grav: through 6.2.1

References

https://github.com/getgrav/grav/security/advisories/GHSA-q5fw-vpqc-fgph
https://www.vulncheck.com/advisories/grav-stored-cross-site-scripting-via-shortcode-attribute-handlers
https://github.com/getgrav/grav/security/advisories/GHSA-q5fw-vpqc-fgph

Get alerted when CVE-2026-64628 or the next vulnerability affects your stack