The vulnerability arises from an error in Grav's XSS detection routine that cannot correctly recognize a closing angle bracket placed inside a quoted attribute value. As a result, an attacker who can edit a page without the admin.super privilege can craft content such as `<img src=x title=">" onerror=alert(document.domain)>`. The offending markup is accepted, stored, and later parsed by browsers which interpret the injected event handler, thereby delivering arbitrary script execution to any visitor, including unauthenticated users. This flaw falls under CWE‑79 and can lead to data theft, phishing or site defacement.

All Grav installations built with versions from 1.5.2 up to and including 2.0.12 are affected. The issue spans every release listed in the known CPE data and can impact any website running these versions where users with limited authoring permissions can store page content.

Exploiting the flaw requires only the ability to edit existing pages; no administrative privileges are necessary. After content is stored, any site visitor becomes a potential victim. The CVSS score of 5.1 places the risk in a moderate category, and the EPSS score is currently not available, so the likelihood of widespread exploitation cannot be precisely quantified. The vulnerability is not listed in CISA's KEV catalog, implying that no large‑scale exploitation has been reported yet, but the attack vector and plug‑in‑level nature of the flaw may make targeted attacks more likely.