CVE-2026-64851 Overview
CVE-2026-64851 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Grav Shortcode Core plugin. The plugin allows content authors to use WordPress and BBCode style shortcodes within Grav CMS pages. Versions prior to 6.2.2 pass shortcode syntax through Security::detectXss(), which fails to flag payloads that omit a literal less-than character. The ColorShortcode.php handler and related attribute handlers then concatenate attacker-controlled parameters into HTML output without encoding. An authenticated user with admin.pages permission can inject an event handler that executes when visitors or administrators render the affected page.
Critical Impact
Authenticated attackers with page-editing rights can execute arbitrary JavaScript in the browsers of site visitors and administrators, enabling session theft and administrative account takeover.
Affected Products
- Grav CMS Shortcode Core plugin versions prior to 6.2.2
- Grav sites permitting user accounts with the admin.pages capability
- Public pages that render shortcodes produced by ColorShortcode.php and related attribute handlers
Discovery Timeline
- 2026-08-19 - CVE-2026-64851 published to NVD
- 2026-08-19 - Last updated in NVD database
Technical Details for CVE-2026-64851
Vulnerability Analysis
The Grav Shortcode Core plugin parses shortcode syntax similar to WordPress and BBCode, converting bracketed tags such as [color=red]text[/color] into HTML. Before rendering, Grav evaluates author input using Security::detectXss() to identify script-like payloads. Because shortcode syntax uses square brackets and contains no literal < character in its raw form, the detection routine treats the input as benign and passes it through to the shortcode handlers.
Inside ColorShortcode.php and related attribute handlers, the attacker-controlled attribute value is concatenated directly into an HTML attribute string without HTML encoding. An attacker with admin.pages permission can supply a crafted attribute value that closes the intended attribute and appends an event handler such as an onmouseover or onerror handler. The result is stored XSS that executes in the context of any user rendering the page, including administrators.
Root Cause
The root cause is a broken input-validation and output-encoding pattern. Security::detectXss() inspects raw input for HTML tag delimiters and misses payloads delivered through shortcode attributes. The shortcode handlers then treat the sanitized input as safe and interpolate it into HTML without contextual encoding, violating the standard defense of encoding untrusted data at the sink.
Attack Vector
An authenticated attacker with admin.pages permission edits or creates a page and inserts a shortcode with a malicious attribute value. The payload breaks out of the intended attribute quoting and introduces a JavaScript event handler. When another user, including an administrator, views the rendered page, the injected handler fires and executes JavaScript in the victim's session. See the GitHub Security Advisory GHSA-q5fw-vpqc-fgph for the technical write-up.
// No verified proof-of-concept published.
// Refer to the vendor advisory for exploit details.
Detection Methods for CVE-2026-64851
Indicators of Compromise
- Stored page content containing shortcode attributes with embedded event handlers such as onmouseover=, onerror=, or onclick=.
- Shortcode attributes containing quote characters that prematurely terminate the generated HTML attribute.
- Audit-log entries showing page edits by accounts with admin.pages permission followed by unexpected script activity in visitor sessions.
Detection Strategies
- Inspect Grav page frontmatter and markdown storage for shortcode attribute values containing suspicious keywords such as javascript:, on event handlers, or encoded quotes.
- Scan rendered HTML output for attribute injection patterns produced by ColorShortcode.php and related handlers.
- Correlate content changes by admin.pages accounts with subsequent client-side alerts from the browser or web application firewall.
Monitoring Recommendations
- Enable and review Grav admin audit logs for page create and update events performed by non-administrator authors.
- Deploy a Content Security Policy (CSP) that reports violations, and monitor CSP reports for inline-script and inline-event-handler violations originating from shortcode-rendered pages.
- Alert on outbound requests from browsers loading Grav pages to unexpected domains, which may indicate exfiltration by injected JavaScript.
How to Mitigate CVE-2026-64851
Immediate Actions Required
- Upgrade the Grav Shortcode Core plugin to version 6.2.2 or later.
- Review all pages authored by accounts with admin.pages permission and remove or sanitize any shortcode attributes containing event handlers or quote-breaking payloads.
- Rotate administrator session cookies and credentials if unauthorized page edits are found.
Patch Information
The issue is fixed in Grav Shortcode Core plugin version 6.2.2. Details are available in the GitHub Release v6.2.2 of Shortcode Plugin and the GitHub Commit for Shortcode Plugin. The commit adds HTML encoding for attribute values inside the affected shortcode handlers.
Workarounds
- Restrict the admin.pages permission to fully trusted administrators until the plugin is upgraded.
- Disable the Shortcode Core plugin on public sites if upgrading is not immediately possible.
- Enforce a strict Content Security Policy that blocks inline event handlers to reduce the impact of any residual injection.
# Update the plugin using the Grav CLI
bin/gpm update shortcode-core
# Verify the installed version is 6.2.2 or later
bin/gpm info shortcode-core
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
