Grav versions before 2.0.14 have a stored cross-site scripting (XSS) vulnerability in the Security::detectXss() function. A single invalid UTF-8 byte in page content causes all XSS detection patterns to fail, bypassing the XSS safety check. An authenticated user with page-edit permissions but without the XSS whitelist privilege can exploit this to store malicious JavaScript that executes in visitors' browsers.