CyberRota Analysis
AI-GeneratedGrav's shortcode-core attribute handlers are vulnerable to stored cross-site scripting due to inadequate validation, allowing attackers with admin.pages permission to inject malicious JavaScript through shortcode attributes. This can lead to session hijacking by stealing admin nonces, impacting all users who view the affected content, including administrators. Organizations using Grav should prioritize patching this vulnerability to safeguard against potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.