blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-64851

HIGH 8.5 CVSS 4.0
Published
August 19, 2026
Last modified
September 9, 2026
NVD status
Deferred
Reported by
security-advisories@github.com
Weakness
CWE-79
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal less-than character, then ColorShortcode.php and related attribute handlers concatenate an attacker-controlled parameter into HTML without encoding. An account with admin.pages permission can close the generated attribute and add an event handler, creating stored cross-site scripting that executes for visitors or administrators who view the page. This issue is fixed in version 6.2.2.

Affected products and versions

  • getgrav grav-plugin-shortcode-core — Version < 6.2.2

References

  • github.com https://github.com/getgrav/grav-plugin-shortcode-core/commit/2a55eac8a2cc7f6c2d4923ab2fa7991039620597
  • github.com https://github.com/getgrav/grav-plugin-shortcode-core/releases/tag/6.2.2
  • github.com https://github.com/getgrav/grav/security/advisories/GHSA-q5fw-vpqc-fgph
  • nvd.nist.gov Official NVD record