Grav-plugin-guestbook CVEs and Security Vulnerabilities

CVE-2026-109322

Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav-plugin-guestbook

CVE-2026-109319

Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation

Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce-less GET requests, can delete or approve Guestbook entries.