CVE-2026-64628Patch

LOWCVSS 5.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Referenced assets1 URL

By indicator

https://github.com/getgrav/grav/security/advisories/GHSA-q5fw-vpqc-fgph

Full discourse1 post

MalwareObserver@MalwareObserver92d
Patch
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-64628](https://github.com/getgrav/grav/security/advisories/GHSA-q5fw-vpqc-fgph) Grav co... https://github.com/getgrav/grav/security/advisories/GHSA-q5fw-vpqc-fgph #ZeroDay #PatchManagement #Vulnerability
Post summary
The tweet announces CVE-2026-64628 in Grav, directing readers to a GitHub advisory that presumably contains patch information, with no PoC, exploit, or active exploitation evidence referenced.
0000037
13 followersView on X

Explore more

Back to dashboard