Grav before version 2.0.15 has a stored cross-site scripting (XSS) vulnerability in the detectXss() function. The flaw allows authenticated editors to inject event-handler attributes such as onerror= by exploiting unpaired quotes in unquoted attribute values, bypassing event-handler detection. This can lead to execution of malicious scripts in visitors' browsers when the affected page content is rendered.