Vulnerability · Published Aug 18, 2026 · Assigned by VulnCheck

CVE-2026-75828Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass

High 8.7

In plain English

A high-severity cross-site scripting in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.7High

Exploit odds (30 days)0.4%top 66.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	getgrav/grav	2.0.15	GHSA-vfmf-q6x9-cw96

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	0 – before 2.0.15

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-vfmf-q6x9-cw96) vendor-advisory
VulnCheck Advisory: Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass third-party-advisory