CVE-2026-109322: Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views

Q: Who can exploit this vulnerability, and who is exposed to the injected content?

An unauthenticated visitor can submit malicious markup in guestbook author or message fields. The markup can execute in other visitors' browsers when AJAX pagination loads it, and in administrator moderation sessions on versions 0.5.0 and 0.5.1.

Q: Are default guestbook submissions a relevant attack path?

Yes. The affected fields are author and message fields, and the issue can be triggered by an unauthenticated visitor submitting markup through the guestbook.

Q: Which application paths render the malicious content?

The vulnerable rendering paths are the AJAX “Load more” handler and the Admin “Load all” handler. Both insert stored guestbook content into the DOM as unescaped HTML via jQuery.

Q: What version resolves the issue?

Upgrade the Grav Guestbook plugin to version 0.5.2 or later. Versions before 0.5.2 are affected.

Published Oct 12, 2026

Updated

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.

Affected Software

1 affected component

Grav Guestbook Plugin<0.5.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Grav Guestbook to a version that resolves this vulnerability.
Fixed in 0.5.2

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability, and who is exposed to the injected content?

An unauthenticated visitor can submit malicious markup in guestbook author or message fields. The markup can execute in other visitors' browsers when AJAX pagination loads it, and in administrator moderation sessions on versions 0.5.0 and 0.5.1.

Are default guestbook submissions a relevant attack path?

Yes. The affected fields are author and message fields, and the issue can be triggered by an unauthenticated visitor submitting markup through the guestbook.

Which application paths render the malicious content?

The vulnerable rendering paths are the AJAX “Load more” handler and the Admin “Load all” handler. Both insert stored guestbook content into the DOM as unescaped HTML via jQuery.

What version resolves the issue?

Upgrade the Grav Guestbook plugin to version 0.5.2 or later. Versions before 0.5.2 are affected.

CVE-2026-109322: Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability, and who is exposed to the injected content?

Are default guestbook submissions a relevant attack path?

Which application paths render the malicious content?

What version resolves the issue?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability, and who is exposed to the injected content?

Are default guestbook submissions a relevant attack path?

Which application paths render the malicious content?

What version resolves the issue?