CVE-2026-109322: Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views
Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Grav Guestbookto a version that resolves this vulnerability.Fixed in 0.5.2
Event History
Frequently Asked Questions
Who can exploit this vulnerability, and who is exposed to the injected content?
An unauthenticated visitor can submit malicious markup in guestbook author or message fields. The markup can execute in other visitors' browsers when AJAX pagination loads it, and in administrator moderation sessions on versions 0.5.0 and 0.5.1.
Are default guestbook submissions a relevant attack path?
Yes. The affected fields are author and message fields, and the issue can be triggered by an unauthenticated visitor submitting markup through the guestbook.
Which application paths render the malicious content?
The vulnerable rendering paths are the AJAX “Load more” handler and the Admin “Load all” handler. Both insert stored guestbook content into the DOM as unescaped HTML via jQuery.
What version resolves the issue?
Upgrade the Grav Guestbook plugin to version 0.5.2 or later. Versions before 0.5.2 are affected.