What the vulnerability does
01Description
Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.
Explanation of Vulnerability in Simple Terms
02Summary
The Grav Shortcode Core plugin before version 6.2.2 contains a cross-site scripting (XSS) vulnerability in shortcode processing. An attacker with low-level site access can inject malicious scripts that execute in other users' browsers when they view affected content. This requires user interaction to trigger the payload.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in other users' browsers when they view the attacker's content.
Potential impact on your site
04Site Impact
Users' sessions can be hijacked, credentials stolen, or site content modified without their knowledge.
Conditions required to exploit
05Prerequisites
Low-level site access (e.g., contributor or editor role) and the victim must view a page containing the malicious shortcode.
Key dates
06Disclosure timeline
August 19, 2026
CVE published
