CVE-2026-109322

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-109322

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109322.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-109322

Aliases

GHSA-jgpj-gchm-6j29

Published

2026-10-12T16:05:14Z

Modified

2026-10-13T02:46:56Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator

Summary

Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views

Details

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109322.json"
}

References

Affected packages

Git / github.com/getgrav/grav-plugin-guestbook

Affected ranges

Type

GIT

Repo

https://github.com/getgrav/grav-plugin-guestbook

Events

Introduced

Fixed

156a20f6f4493228be31bceceefbd91e67647dc8

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.5.2"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

0.*

0.3.0

0.3.1

0.4.0

0.5.0

0.5.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109322.json"