CVE-2026-64628: Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers
Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64628?
The severity of CVE-2026-64628 is medium, with a score of 5.4.
What type of vulnerability is identified in CVE-2026-64628?
CVE-2026-64628 is a stored cross-site scripting (XSS) vulnerability.
How can an attacker exploit CVE-2026-64628?
An attacker with admin.pages permission can inject malicious JavaScript through shortcode parameters that bypass XSS validation.
How do I fix CVE-2026-64628?
To fix CVE-2026-64628, ensure that all shortcode parameters are properly validated and sanitize user input to prevent injection.
Which software is affected by CVE-2026-64628?
CVE-2026-64628 affects the Grav content management system.