Grav CMS CVE-2026-64628

Q: What is the CVSS score of CVE-2026-64628?

CVE-2026-64628 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-46181 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-21 VulnCheck

GHSA-r7ww-mw2x-mj59

XSS Grav Getgrav

5.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable stored XSS; low privileges (admin.pages); passive viewer required; scope changes to victim browser; low C and I for session/nonce impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 12:31 vuln.today

DescriptionCVE.org

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.

AnalysisAI

Stored XSS in Grav CMS shortcode-core attribute handlers allows authenticated users with admin.pages permission to inject persistent JavaScript payloads that bypass the CMS's XSS detection filter and execute in any visitor's browser. The filter flaw is root-cause critical: it only flags payloads containing literal angle brackets, leaving event-handler and attribute-based injection vectors entirely unblocked. When an administrator views an affected page, the injected script can steal admin session nonces, enabling full account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the impact chain - from low-privilege content editor to admin session hijack - is straightforward.

Technical ContextAI

Grav is a flat-file PHP CMS. The shortcode-core plugin provides a templating shortcode syntax that allows page authors to embed rich content via bracketed parameters. The attribute handlers in shortcode-core parse and render user-supplied parameter values into HTML output. The CWE-79 root cause is an incomplete input sanitization strategy: the XSS scan relies on detecting literal '<' or '>' characters in attribute values, which blocks only the most naive payloads (e.g., <script>) while leaving event-handler injections (e.g., onmouseover=fetch(...)) and other bracket-free payloads unexamined. The affected CPE is cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:* - no version ceiling is specified in the available intelligence, meaning all tracked Grav versions are potentially affected until a patched release is confirmed.

RemediationAI

Consult the vendor's GitHub Security Advisory at https://github.com/getgrav/grav/security/advisories/GHSA-q5fw-vpqc-fgph for the specific patched version - an exact fixed release version was not independently confirmed in the available intelligence, so the advisory is the authoritative source. Until a patch is applied, the most effective compensating control is to revoke or tightly restrict the admin.pages permission to only fully trusted users, since this permission is the sole prerequisite for exploitation. Disabling the shortcode-core plugin entirely removes the attack surface but will break any pages relying on shortcode syntax. Deploying a Content Security Policy (CSP) header that disallows inline scripts (script-src 'self') reduces the impact of any injected payload, though CSP configuration must be tested against legitimate Grav functionality to avoid breakage. Generic WAF rules that block angle brackets in request bodies will not mitigate this vulnerability, as the bypass specifically avoids angle brackets.