Executive brief
Grav's Shortcode Core plugin allows administrators to add styled text and colored elements to pages using a WordPress-like syntax. Before version 6.2.2, the plugin fails to properly escape user-controlled parameters when generating HTML attributes (such as color, size, id, class, or style), allowing an attacker with page-editing permissions to inject malicious JavaScript that executes when other administrators or site visitors view the affected page.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Shortcode Core plugin's attribute handling. The plugin passes shortcode parameters through a basic XSS detection routine that only checks for literal less-than characters; parameters without "<" bypass this check. However, ColorShortcode.php and related attribute handlers then concatenate these unescaped attacker-controlled values directly into HTML attributes, allowing an attacker to close the attribute with a quote, inject additional attributes, and add event handlers (e.g., `onclick`, `onload`). An account with `admin.pages` permission can exploit this to create persistent XSS payloads. The vulnerability was fixed in version 6.2.2 by properly escaping attribute values when writing them to the page.
Affected products
- Grav Shortcode Core Plugin before 6.2.2
Timeline
- 2026-08-19: disclosed
- 2026-07-03: patched: Version 6.2.2 released with escape attributes fix