What’s Vulnerable › Vulnerabilities

CVE-2026-109322: Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-15
• Weakness: CWE-79

Description

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.

Affected products

• getgrav grav-plugin-guestbook: before 0.5.2 — fixed in 0.5.2

How to fix

Upgrade to a fixed version: getgrav grav-plugin-guestbook 0.5.2. Check the vendor advisory for mitigations.

References

• https://github.com/getgrav/grav/security/advisories/GHSA-jgpj-gchm-6j29
• https://www.vulncheck.com/advisories/grav-guestbook-before-0.5.2-stored-xss-via-ajax-pagination-and-admin-views

Get alerted when CVE-2026-109322 or the next vulnerability affects your stack