CVE-2026-109322

Name of the Vulnerable Software and Affected Versions Grav Guestbook plugin versions prior to 0.5.2

Description Stored cross-site scripting occurs because the AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. This allows unauthenticated visitors to submit markup that executes in the browsers of other visitors and, specifically in versions 0.5.0 and 0.5.1, within administrator moderation sessions.

Recommendations Update Grav Guestbook plugin to version 0.5.2 or later.