Stored Cross-Site Scripting in Grav Shortcode Core

Grav Shortcode Core, a plugin for the Grav CMS, contains stored cross-site scripting (XSS) vulnerabilities affecting versions prior to 6.2.5. The vulnerability arises from insufficient sanitization of parameters within the [lorem] and [details] shortcodes, which are rendered directly into HTML without proper escaping. An attacker possessing page-editing privileges can inject malicious JavaScript into these tags. When other users or administrators visit the compromised page, the injected payload executes in their browser session. This allows for session hijacking, unauthorized actions performed on behalf of the victim, or credential theft. Given that administrators are susceptible to this attack, successful exploitation could lead to full site compromise if the attacker elevates privileges by targeting a logged-in administrative session.

Impact

Successful exploitation results in the execution of arbitrary JavaScript in the browsers of users viewing the injected content. This poses a significant risk to the integrity and confidentiality of the CMS, particularly if administrative users view the compromised pages. It may lead to full site takeover through the unauthorized execution of administrative actions.

Recommendation

Prioritized actions for administrators:

• Upgrade the Grav Shortcode Core plugin to version 6.2.5 or later immediately.
• Review all existing content pages for suspicious use of [lorem] or [details] tags if page-editing privileges have been shared with untrusted users.
• Audit user roles and permissions to ensure that page-edit capabilities are restricted to authorized personnel.