Medium severity · published Oct 12, 2026
CVE-2026-109322
Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GR
grav-plugin-guestbook · getgrav
before 0.5.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-109322
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-109322
vendor-advisory
https://github.com/getgrav/grav/security/advisories/GHSA-jgpj-gchm-6j29
third-party-advisory
https://www.vulncheck.com/advisories/grav-guestbook-before-0.5.2-stored-xss-via-ajax-pagination-and-admin-views
More from grav-plugin-guestbook
4.3
CVE-2026-109319
Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation