Skip to content
OpenAdvisories

Product · getgrav

grav-plugin-guestbook

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    CVE-2026-109322

    Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views

    Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can subm…

    getgrav grav-plugin-guestbook
  • Medium 4.3
    CVE-2026-109319

    Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation

    Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external site…

    getgrav grav-plugin-guestbook