CVE-2026-75831 is a stored cross-site scripting vulnerability affecting Grav CMS prior to version 2.0.15. The flaw exists in the sourceParsedownElement method used for rendering audio and video media, where the media URL fragment is inserted into raw HTML elements without proper neutralization. This improper input handling allows attackers to inject malicious HTML and JavaScript code, which executes when other users view the affected media content.

Successful exploitation of this vulnerability enables attackers to execute arbitrary JavaScript in the context of users viewing the affected media content. This can lead to session hijacking, defacement, or other malicious actions within the user's session. The vulnerability requires user interaction and low attack complexity, with no privileges or user consent needed beyond viewing the malicious content.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 2.0.15, upgrading to version 2.0.15 or later is likely the intended remediation once officially released. Until then, avoid using untrusted media URLs in audio and video rendering or apply any vendor-provided temporary mitigations.