CVE-2026-109322
Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.
| CWE | CWE-79 |
| Vendor | getgrav |
| Product | grav-plugin-guestbook |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for getgrav grav-plugin-guestbook
Be the first to know when new medium vulnerabilities affecting getgrav grav-plugin-guestbook are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
getgrav / grav-plugin-guestbook
0 < 0.5.2
References
Credits
🔍 AlpetGexha