CVE-2026-64851: Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers
Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav Shortcode Core Pluginto a version that resolves this vulnerability.Fixed in 6.2.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an account with the admin.pages permission and the ability to save shortcode content containing a crafted attribute parameter.
Who is exposed to the stored script?
The injected script can execute when visitors or administrators view the affected page. The vulnerable content is stored, so exposure persists until the malicious shortcode content is removed or corrected.
Which versions are affected and what is the fix?
Versions prior to 6.2.2 are affected. Upgrade Grav Shortcode Core Plugin to version 6.2.2.
What can be done if upgrading is not immediately possible?
Restrict admin.pages permission to trusted users and review pages containing shortcode attributes for attacker-controlled values that could close an HTML attribute and add an event handler. Remove or correct any suspicious stored shortcode content.