The Grav Shortcode Core Plugin, used to build WordPress‑style shortcodes, previously passed shortcode syntax through a detection helper but did not properly escape values supplied to attribute handlers. In particular, ColorShortcode.php concatenates attacker‑controlled attributes directly into generated HTML without encoding. A user with the admin.pages permission can embed a cleverly crafted shortcode that terminates the attribute and injects a JavaScript event handler. The resulting malicious code is stored with the page content and is executed whenever anyone—visitors or administrators—views the page. This stored cross‑site scripting enables client‑side code execution.

This vulnerability affects all installations of Grav that use the Shortcode Core plugin version 6.2.1 or earlier. The plugin is distributed under the getgrav:grav-plugin-shortcode-core CNA, and the issue remains until version 6.2.2 when the escape logic is corrected.

The CVSS score of 8.5 classifies this vulnerability as high severity. The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The flaw requires an attacker to have an account with the admin.pages permission to embed malicious shortcodes. Once that permission is obtained, the attacker can store the injected code in a page, causing it to execute for any user who views that page.