The vulnerability stems from a blacklist bypass in Grav's detectXss() routine that fails to sanitize unquoted HTML event attributes. A publisher‑level user can store malicious JavaScript that is later executed in any browser that renders the page, potentially leaking session data, defacing content or redirecting users. This stored Cross‑Site Scripting (CWE‑79) can be exploited at the level of the content author, meaning any reading user falls victim when the page is viewed.

All Grav installations using getgrav:grav before version 2.0.0‑beta.2 are vulnerable. The affected product is the Grav file‑based web platform with unpatched detectXss() handling. Any instance running a version older than 2.0.0‑beta.2 should be considered at risk.

The CVSS score of 8.5 indicates a high risk, but the EPSS score is not available, suggesting the probability of exploitation is unclear. The vulnerable code is in content storage, so exploitation requires a compromised or compromised publisher‑level account or an attacker who can inject content into the system. Once the malicious payload resides in the database, any visitor to the affected page will execute the script, allowing the attacker to carry out session hijacking, phishing, or data theft. The vulnerability is not listed in CISA's KEV catalog, so no known widespread exploitation has been reported, but the high severity warrants immediate remediation.