getgrav/grav-plugin-shortcode-core 6.2.5

on GitHub

Bugfix

• [security] The [lorem] shortcode's tag option is now restricted to a plain tag name, closing a hole where a crafted value could attach an event handler to the generated markup and run script in a visitor's or an administrator's browser (GHSA-hvm8-wx3f-j774).
• [security] The [details] shortcode's summary text is now escaped when written into the page, so markup in a summary is shown as text instead of being rendered.