CVE-2026-64851
Received Received - Intake

Stored XSS in Grav Shortcode Core Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-64851
EUVD
EUVD-2026-62548

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
getgrav grav_shortcode_core to 6.2.2 (exc)
getgrav grav_plugin_shortcode_core to 6.2.2 (exc)
grav shortcode_core_plugin to 6.2.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Grav CMS Shortcode Core plugin. It occurs because shortcode parameters like color, size, ID, class, or style are not properly escaped when rendered in HTML. Attackers with admin.pages permission can inject malicious JavaScript by crafting values that break out of HTML attributes. The payload executes in browsers of visitors or administrators, potentially allowing privilege escalation.

Detection Guidance

Check Grav CMS version with: grep -r 'shortcode-core' /path/to/grav/version.txt. If version is below 6.2.2, the system is vulnerable. Inspect pages for unusual shortcode parameters like onmouseover or other event handlers in HTML attributes.

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf with admin privileges, or deface your website. Visitors or administrators viewing affected pages may have their browsers compromised. The vulnerability allows cross-site request forgery (CSRF) attacks if combined with other flaws, as admin nonces could be exposed.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it risks exposing protected health information. Both standards require protecting user data from unauthorized access, which this flaw undermines by enabling script execution in user browsers.

Mitigation Strategies

Upgrade Grav Shortcode Core plugin to version 6.2.2 or later. Review and remove any suspicious shortcode parameters in pages. Restrict admin.pages permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64851. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart