CVE-2026-109322: medium-severity vulnerability in getgrav grav-plugin-guestbook
Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views
Published
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3
exploitation probability
—
observed exploitation
nono source reports it
Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
getgrav · grav-plugin-guestbookRelated CVEs — getgrav grav-plugin-guestbook
In the same product, most dangerous first.