CVE-2026-64851 in Shortcode Core Plugin
Summary
by MITRE • 08/19/2026
Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The Grav Shortcode Core plugin serves as a foundational component for extending functionality within the Grav content management system by supporting shortcode syntaxes common to WordPress and BBCode ecosystems. While this flexibility allows developers to create rich, dynamic content structures, it introduces significant security considerations regarding input validation and output encoding. The vulnerability identified in versions prior to 6.2.2 stems from a flawed implementation of cross-site scripting (XSS) detection logic within the plugin's core processing pipeline. Specifically, the Security::detectXss() function relies on a simplistic heuristic that checks for the presence of literal less-than characters (<). This approach is fundamentally insufficient because it fails to account for alternative vectors through which malicious scripts can be injected or executed in a browser environment.
The technical flaw manifests when attribute handlers, such as those found in ColorShortcode.php and related modules, process user-supplied data. These components concatenate attacker-controlled parameters directly into HTML attributes without applying proper encoding mechanisms. Because the initial XSS detection step only looks for less-than signs, an attacker can bypass this check by utilizing other syntactic constructs that trigger script execution or event handler attachment within the resulting HTML structure. This oversight allows malicious payloads to persist in the system's data stores rather than being sanitized at the point of entry or output.
The operational impact of this vulnerability is severe due to its classification as a stored cross-site scripting issue. An attacker with admin.pages permission can inject these malformed shortcodes into pages that are subsequently viewed by other users, including administrators and regular visitors. When a victim loads the compromised page, their browser interprets the unencoded attributes, leading to the execution of arbitrary JavaScript code within the context of the Grav application's domain. This capability enables session hijacking, credential theft, defacement, or further exploitation of backend features depending on the privileges held by the viewing user and the specific payload delivered.
This vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The failure to encode output before insertion into HTML attributes represents a classic instance where input validation is insufficient without corresponding output encoding safeguards. Furthermore, from an offensive security perspective such as the MITRE ATT&CK framework, this flaw facilitates techniques associated with Client-side Injection and potentially Account Manipulation if administrative privileges are leveraged for persistent access or data exfiltration. The reliance on heuristic-based filtering rather than robust sanitization libraries highlights a common pitfall in custom content processing logic where edge cases and alternative execution contexts are not adequately considered during development.
To mitigate this risk, organizations running Grav installations must upgrade the Shortcode Core plugin to version 6.2.2 or later immediately. This update addresses the underlying issue by implementing more rigorous input validation and ensuring that all dynamic content is properly encoded before being rendered in HTML attributes. Administrators should also audit existing pages for any potentially malicious shortcodes introduced prior to the patching event, as stored XSS payloads may persist even after the software vulnerability is fixed if not manually removed from the database or file system. Implementing a Content Security Policy (CSP) can provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby reducing the impact of any future exploitation attempts that might bypass application-level controls.