The vulnerability is a stored cross‑site scripting flaw introduced by the media rendering code for audio and video elements in Grav. Because the source URL is concatenated directly into the raw HTML element without escaping, an attacker who can inject a malicious URL will cause arbitrary HTML or JavaScript to run in the browsers of anyone who views the page. The flaw enables the execution of code in the context of the site, allowing attackers to steal session cookies, deface content, or perform other actions that require the victim’s user rights. The weakness is identified as CWE‑79, indicating an input handling bug that leads to scripting injection.

Grav content‑management systems running a version earlier than 2.0.15 are affected. Any deployment using Grav prior to this release, regardless of operating system or web server, may host the vulnerable media code and thus be susceptible to exploitation.

Not recognized in KEV; no exploitability indicator is available in EPSS. The vulnerability's moderate CVSS score reflects that exploitation requires only the ability to supply a malicious media URL; the consequence is client‑side code execution. Monitoring for attempts to host or view suspicious media URLs, and implementing a content security policy that limits script execution, can mitigate the risk while a permanent fix is applied.