Grav Guestbook CVE-2026-109322

Exploitation requires that the Grav Guestbook plugin (before 0.5.2) be installed with public, unauthenticated entry submission enabled - the default guestbook use case - and that the vulnerable AJAX 'Load more' pagination handler or the admin 'Load all' moderation view be used to render stored entries, since those specific handlers insert the author/message fields as unescaped HTML via jQuery. Injection itself needs no authentication (PR:N). Execution is limited by required victim interaction (UI:P/UI:R): the payload only fires when another visitor triggers AJAX pagination, or, for the higher-value administrator-session impact, only on versions 0.5.0 and 0.5.1 when a moderator opens the admin view. Sites that do not use the AJAX load handlers, or that run 0.5.2+, are not exploitable.

This is a medium-severity stored XSS (CWE-79) in the Grav Guestbook plugin, scored CVSS 5.3 via the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N). The signals are internally consistent: network vector, low complexity, no privileges, but passive user interaction (a victim must load the guestbook page/pagination), and impact is confined to the subsequent system (the victim browser) with low confidentiality and integrity impact and no availability impact - hence no direct server compromise. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the low raw score plus absent exploitation signals make this a routine-priority web hygiene issue rather than an emergency. The one factor that raises relative concern is that injection is unauthenticated and the stored payload can fire in administrator moderation sessions on 0.5.0/0.5.1, creating a privilege-boundary risk (admin session hijack/CSRF-style actions) that the aggregate CVSS score understates. Treat as a priority proportional to admin exposure: patch promptly on sites running 0.5.0/0.5.1 where moderators review submissions, lower priority otherwise.

An unauthenticated visitor submits a guestbook entry whose author or message field contains HTML/JavaScript markup. When another visitor later loads additional entries via the AJAX 'Load more' handler - or an administrator opens the 'Load all' moderation view in 0.5.0/0.5.1 - jQuery inserts the stored field as unescaped HTML and the script executes in that user's browser. No public exploit code was identified, but the payload is trivial to craft given the unescaped-innerHTML sink.