CVE-2026-64628

MediumCVSS 5.4/10Last modified Oct 24, 2026

Description

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-646297.8A vulnerability has been identified in Parasolid V38.0 (All versions < V38.0.235), Parasolid V38.1 (All versions < V38.1.230). The affected CVE-2026-646305.3A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link.CVE-2026-646318.6A vulnerability allowing a low-privileged user to inject SQL and extract database contents.CVE-2026-646328.5A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.CVE-2026-6463310.0A vulnerability allowing remote unauthenticated code execution on the agent host.CVE-2026-646348.4A vulnerability allowing local privilege escalation to the Reporter service context.CVE-2026-646355.3Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated att CVE-2026-646367.7An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data fro CVE-2026-646379.9Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative sessi CVE-2026-646388.9WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party webs CVE-2026-646399.3Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to CVE-2026-64648.1Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via er