CVE-2026-109322

medium

Description

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.

References

https://www.vulncheck.com/advisories/grav-guestbook-before-0.5.2-stored-xss-via-ajax-pagination-and-admin-views

https://github.com/getgrav/grav/security/advisories/GHSA-jgpj-gchm-6j29

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-97624

Details

Source: Mitre, NVD

Published: 2026-10-12

Updated: 2026-10-15

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Severity: Medium

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Severity: Medium

EPSS

EPSS: 0.002