grav-plugin-shortcode-core vulnerabilities

2 known vulnerabilities in grav-plugin-shortcode-core from Grav. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  grav-plugin-shortcode-core: Improper Neutralization of Input During Web Page Generation

  CVE-2026-85599Sep 4, 2026Grav

  Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML an

• 8.5 High severity

  grav-plugin-shortcode-core: Improper Neutralization of Input During Web Page Generation

  CVE-2026-64851Aug 19, 2026Grav

  Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss() because it contains no literal le