CVE-2026-75828: Getgrav Grav

High severity, CVSS 8.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered.

Affected products

• Getgrav Grav: before 2.0.15 (fixed in 2.0.15)

Published 2026-08-18. Last modified 2026-10-08.