CVE-2026-85599: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in getgrav grav-plugin-shortcode-core

CVE-2026-85599 is a stored cross-site scripting vulnerability in the Grav Shortcode Core plugin prior to version 6.2.5. The vulnerability arises because the [lorem] tag parameter and the [details] summary parameter are written to rendered pages without proper input neutralization or escaping. An attacker who has page-editing privileges can exploit this flaw to inject arbitrary HTML and JavaScript code, which will execute in the context of any user viewing the affected page, potentially leading to session hijacking or other client-side attacks.

Attackers with page-edit access can inject malicious scripts that execute in the browsers of all visitors to the affected pages, including administrators. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information, or other client-side attacks. The vulnerability requires at least limited privileges (page-edit access) and user interaction (visiting the malicious page).

Upgrade Grav Shortcode Core to version 6.2.5 or later, where this vulnerability has been fixed. There is no indication that temporary mitigations or workarounds are available. Patch status is confirmed by the affectedVersions field indicating versions before 6.2.5 are vulnerable.