CVE-2026-72832 Grav before 2.0.12 Stored XSS via quoted-attribute bypass

Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss function system/src/Grav/Common/Security.php. The event-handler scan is anchored at ?, which cannot cross the first literal ; when a appears inside a quoted attribute value the...