Grav CMS has a stored cross‑site scripting flaw in its shortcode‑core attribute handlers. The vulnerability arises because the detection routine only checks for literal angle brackets, so malicious script payloads embedded in shortcode attributes can bypass the validation. This allows an attacker who can edit pages (admin.pages permission) to inject JavaScript that executes in the browser of any visitor, including administrators, effectively enabling session hijacking through nonce theft. The weakness is a classic input‑validation error classified as CWE‑79.

All installations of Grav CMS that are running the affected code base are potentially impacted. The advisory does not list specific version numbers, implying that current releases are at risk until a patch is applied. The vulnerability applies to the core shortcode processing functionality supplied by the getgrav:grav package.

The CVSS score of 5.1 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Attackers must have authenticated administrative privileges with the admin.pages permission to inject the payload, but the impact is widespread since the injected script runs in the browsers of any user who views the compromised content. The flaw is relatively straightforward to exploit when administrative access is available, and the lack of a defensive runtime check makes mitigation primarily a patching effort.