---
id: CVE-2026-64851
title: >-
  Grav Shortcode Core Plugin allows for the development shortcode plugins that
  utilize the common format utilized by WordPress and BBCode
summary: >-
  Grav Shortcode Core Plugin allows for the development shortcode plugins that
  utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2,
  Grav Shortcode Core passes shortcode syntax through Security::detectXss()
  because it…
severity: none
cwe:
  - CWE-79
published: '2026-08-19'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:13:25.910'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-64851'
references:
  - url: >-
      https://github.com/getgrav/grav-plugin-shortcode-core/commit/2a55eac8a2cc7f6c2d4923ab2fa7991039620597
    label: security-advisories@github.com
  - url: 'https://github.com/getgrav/grav-plugin-shortcode-core/releases/tag/6.2.2'
    label: security-advisories@github.com
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-q5fw-vpqc-fgph'
    label: security-advisories@github.com
  - url: 'https://github.com/getgrav/grav/security/advisories/GHSA-q5fw-vpqc-fgph'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.0046
epssPercentile: 0.372
ingestedAt: '2026-09-09T21:22:45.540Z'
---

## Overview

Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.