Vulnerability · Published Jul 21, 2026 · Assigned by VulnCheck

CVE-2026-64628Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers

Medium 5.4

In plain English

A medium-severity cross-site scripting in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 92.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	0 – through 6.2.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-q5fw-vpqc-fgph) vendor-advisory
VulnCheck Advisory: Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers third-party-advisory