CVE-2026-85599
Received Received - Intake

Stored XSS in Grav Shortcode Core

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browsers of all page visitors, including administrators.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85599
EUVD
EUVD-2026-71022

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getgrav grav_shortcode_core to 6.2.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Grav Shortcode Core versions before 6.2.5. It affects the [lorem] tag parameter and [details] summary parameter, which are not properly escaped when rendered. Attackers with page-edit access can inject malicious HTML and JavaScript that executes in the browsers of all page visitors, including administrators.

Detection Guidance

To detect this vulnerability, inspect Grav CMS installations for versions before 6.2.5. Check for unescaped [lorem] and [details] shortcode parameters in page content. Use commands like grep -r "\[lorem" /path/to/grav or grep -r "\[details" /path/to/grav to search for suspicious shortcodes.

Impact Analysis

If exploited, this vulnerability allows attackers to inject malicious scripts into web pages. This could lead to unauthorized actions on behalf of users, theft of sensitive data, session hijacking, or defacement of the website. Users with page-edit permissions can carry out these attacks without needing advanced privileges.

Compliance Impact

This vulnerability could lead to data breaches, exposing personal or sensitive information. Under GDPR, this may result in significant fines for inadequate data protection. For HIPAA, it could compromise protected health information, leading to compliance violations and penalties.

Mitigation Strategies

Immediately upgrade Grav Shortcode Core to version 6.2.5 or later. If upgrading is not possible, audit all page content for malicious [lorem] or [details] shortcodes and remove any suspicious payloads. Restrict page-edit permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85599. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart