CyberRota Analysis
AI-GeneratedGrav Shortcode Core versions prior to 6.2.5 are vulnerable to stored cross-site scripting (XSS) attacks through the [lorem] tag and [details] summary parameters, allowing attackers with page-edit access to inject malicious HTML and JavaScript. This vulnerability can lead to unauthorized actions being executed in the browsers of all users, including administrators, potentially compromising sensitive data and site integrity. Organizations using Grav that allow user-generated content should prioritize patching to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browsers of all page visitors, including administrators.