CVE-2026-75828
HighCVSS 8.7Summary
Grav before version 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.
Risk Assessment
The risk involves execution of malicious scripts in the user's browser, potentially leading to session theft, account takeover, or malware distribution.
Recommendation
Update Grav to version 2.0.15 or later and restrict editor permissions to trusted users.
Original NVD description (English source)
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.