ZeroDay Findings
Sign inSign up

Findings

CVE-2026-109322

Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views

Published Oct 12, 2026 · updated Oct 15, 2026 · getgrav grav-plugin-guestbook

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 12, 2026 · NIST NVD

    Detected

    Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.

  2. Oct 15, 2026 · NIST NVD

    Updated

    Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.

  3. Oct 15, 2026 · NIST NVD

    Updated

    Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.

Affected

  • vendor getgrav grav-plugin-guestbookversion unspecified

Sources

  • CIRCL Vulnerability LookupVulnerability recordCVE-2026-109322

    Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that execut

    vulnerability.circl.lu
  • CVE.orgVulnerability recordCVE-2026-109322

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-109322

    30-day exploitation probability 0.2%

    first.org
  • NIST NVDVulnerability recordCVE-2026-109322

    Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that execut

    nvd.nist.gov

References