CVE-2026-109322
Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 12, 2026
- Updated
- Oct 15, 2026
- Reserved
- Oct 12, 2026
Description
Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | VulnCheck |
| 3.1 | 6.1 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | VulnCheck |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
grav-plugin-guestbookgetgrav |
|
References
- GitHub Security Advisory (GHSA-jgpj-gchm-6j29)vendor-advisorythird-party-advisory
- VulnCheck Advisory: Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Viewsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.