Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| getgrav | grav-plugin-guestbook | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 12 Oct 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions. | |
| Title | Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views | |
| Weaknesses | CWE-79 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-12T16:05:14.089Z
Reserved: 2026-10-12T14:15:29.011Z
Link: CVE-2026-109322
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-12T17:17:27.400
Modified: 2026-10-12T17:17:27.400
Link: CVE-2026-109322
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-12T18:45:15Z
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')