[CRITICAL] Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

PKSA-tr1n-vmpf-rmt6 CVE-2026-75828 GHSA-vfmf-q6x9-cw96

Affected package: getgrav/grav

Affected version: <=2.0.14

Reported by:
GitHub