High severity7.2NVD Advisory· Published Sep 4, 2026· Updated Sep 8, 2026
CVE-2026-85599
CVE-2026-85599
Description
Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browsers of all page visitors, including administrators.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <6.2.5
Patches
Vulnerability mechanics
References
2News mentions
2- Grav CMS: Seven Vulnerabilities Including RCE and XSS Disclosed in Early September 2026Vypr Intelligence · Sep 5, 2026
- Grav CMS: Five Vulnerabilities Including Privilege Escalation and XSS Disclosed TogetherVypr Intelligence · Sep 5, 2026