Grav Plugin Guestbook
Monthly
Stored cross-site scripting (CWE-79) in the Grav Guestbook plugin before 0.5.2 lets unauthenticated visitors persist markup in guestbook author and message fields that is later rendered as unescaped HTML through jQuery by the AJAX 'Load more' pagination handler and the admin 'Load all' moderation view. Because the CVSS vector carries PR:N, submission of the payload requires no authentication, but execution depends on victim interaction (UI:P/UI:R) - another visitor must trigger AJAX pagination, or, on versions 0.5.0 and 0.5.1 specifically, an administrator must open the moderation view, which elevates the impact to a moderation-session compromise. Rated CVSS 5.3 (vendor CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:P/SC:L/SI:L) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing authorization and cross-site request forgery flaws in the Grav Guestbook plugin versions 0.5.0 and 0.5.1 allow an authenticated admin without the admin.guestbook permission, or an external site leveraging a logged-in moderator's session via nonce-less GET requests, to delete or approve guestbook entries. The impact is limited to the integrity of guestbook content, with no confidentiality or availability effect and no code execution. The CVSS 4.0 base score is 5.3, no public exploit code is identified in the provided intelligence, and the issue is not listed in CISA KEV.
Stored cross-site scripting (CWE-79) in the Grav Guestbook plugin before 0.5.2 lets unauthenticated visitors persist markup in guestbook author and message fields that is later rendered as unescaped HTML through jQuery by the AJAX 'Load more' pagination handler and the admin 'Load all' moderation view. Because the CVSS vector carries PR:N, submission of the payload requires no authentication, but execution depends on victim interaction (UI:P/UI:R) - another visitor must trigger AJAX pagination, or, on versions 0.5.0 and 0.5.1 specifically, an administrator must open the moderation view, which elevates the impact to a moderation-session compromise. Rated CVSS 5.3 (vendor CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:P/SC:L/SI:L) and independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Missing authorization and cross-site request forgery flaws in the Grav Guestbook plugin versions 0.5.0 and 0.5.1 allow an authenticated admin without the admin.guestbook permission, or an external site leveraging a logged-in moderator's session via nonce-less GET requests, to delete or approve guestbook entries. The impact is limited to the integrity of guestbook content, with no confidentiality or availability effect and no code execution. The CVSS 4.0 base score is 5.3, no public exploit code is identified in the provided intelligence, and the issue is not listed in CISA KEV.