CVE-2026-75828 is a stored cross-site scripting vulnerability in the Grav CMS prior to version 2.0.15. The flaw exists in the detectXss() function, which fails to properly neutralize input containing unpaired quotes in unquoted attribute values. This allows authenticated editors to inject malicious event handlers (e.g., onerror=) that pass validation and execute in the browsers of visitors viewing the affected pages. The vulnerability requires authentication with editor privileges and results in high-impact client-side script execution.

An attacker with authenticated editor access can inject malicious scripts that execute in the browsers of site visitors, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability has a high CVSS score of 9.3, indicating critical severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability of the client environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor privileges to trusted users only and monitor for suspicious content injections. Avoid exposing editor accounts to untrusted parties.