CVE-2026-109322
6.1MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Unauthenticated attackers can execute arbitrary JavaScript in visitors' and administrators' browsers by submitting malicious guestbook entries. Attackers need a victim to view the guestbook or open the admin moderation panel.
Root cause
The AJAX pagination and admin views insert stored author and message inputs directly into the DOM as unescaped HTML using jQuery.
Affected systems
Grav Guestbook plugin versions prior to 0.5.2 (administrator sessions specifically affected in 0.5.0 and 0.5.1)
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade the Grav Guestbook plugin to version 0.5.2 or later. If patching immediately is not possible, disable the Guestbook plugin.
$ bin/gpm install guestbookAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.