Stored Cross-Site Scripting in Grav Guestbook Plugin by Grav

CVE-2026-109322

What is CVE-2026-109322?

The Grav Guestbook plugin, prior to version 0.5.2, is susceptible to a stored cross-site scripting vulnerability. This security flaw arises from the AJAX Load more and Admin Load all handlers, which inadequately sanitize user input—specifically, stored author and message fields—before inserting them into the Document Object Model (DOM) as unescaped HTML. As a result, unauthenticated users can submit malicious markup that will execute on the browsers of other visitors, including during administrator moderation sessions in versions 0.5.0 and 0.5.1.

References