The Grav Shortcode Core Plugin allows shortcode plugins using a format similar to WordPress and BBCode. Before version 6.2.2, the plugin passes shortcode syntax through Security::detectXss(), which does not detect literal less-than characters. Consequently, ColorShortcode.php and related attribute handlers concatenate attacker-controlled parameters into HTML without encoding. An attacker with admin.pages permission can close the generated attribute and add an event handler, resulting in stored cross-site scripting that executes when the page is viewed by visitors or administrators. This issue is addressed in version 6.2.2.

Successful exploitation allows an attacker with administrative page permissions to inject stored cross-site scripting payloads. These payloads execute in the context of users viewing the affected pages, potentially leading to session hijacking, privilege escalation, or other malicious actions within the affected application.

Upgrade the Grav Shortcode Core Plugin to version 6.2.2 or later, where this vulnerability is fixed. No other mitigation is indicated by the vendor advisory.