CVE-2026-75828: Stored Cross-Site Scripting Vulnerability in Grav CMS
A stored cross-site scripting (XSS) vulnerability exists in Grav CMS versions prior to 2.0.15. The vulnerability is caused by the detectXss() function failing to properly detect event handlers in unpaired quotes in unquoted attribute values. Authenticated editors can inject malicious event handlers, such as onerror=, that can execute in visitor browsers when page content is rendered. The vulnerability has a CVSS score of 8.7 and is classified as HIGH severity. Organizations using Grav CMS should upgrade to version 2.0.15 or later to mitigate this vulnerability.