Skip to content
OpenAdvisories

Product · getgrav

grav-plugin-shortcode-core

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.2
    CVE-2026-85599

    Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters

    Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML a…

    getgrav grav-plugin-shortcode-core
  • High 8.5
    CVE-2026-64851

    Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers

    Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal l…

    getgrav grav-plugin-shortcode-core