CVE-2026-109322GHSA-jgpj-gchm-6j29
grav-plugin-guestbook: Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views
getgrav grav-plugin-guestbook
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.20%Chance of exploitation activity in the next 30 days, higher than 9% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 0.5.2grav-plugin-guestbookCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.
Text from CVE List
Affected versions 2
- grav-plugin-guestbookaffected: all versions before 0.5.2CVE List
- grav-plugin-guestbookunaffected: 0.5.2CVE List