High severity8.7NVD Advisory· Published Aug 18, 2026· Updated Sep 8, 2026
CVE-2026-75828
CVE-2026-75828
Description
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
getgrav/gravPackagist | < 2.0.15 | 2.0.15 |
Affected products
1Patches
Vulnerability mechanics
References
4News mentions
2- Getgrav CMS: Eight Vulnerabilities Including High Severity Flaws Disclosed TogetherVypr Intelligence · Aug 19, 2026
- Grav CMS: Critical Privilege Escalation and XSS Flaws Disclosed TogetherVypr Intelligence · Aug 18, 2026