CVE-2026-109322: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in getgrav grav-plugin-guestbook

CVE-2026-109322 is a stored cross-site scripting vulnerability in the Grav Guestbook plugin prior to version 0.5.2. The vulnerability arises from improper neutralization of input during web page generation, specifically in the AJAX Load more and Admin Load all handlers. These handlers insert stored author and message fields into the DOM as unescaped HTML using jQuery, allowing unauthenticated users to submit malicious markup. This markup executes in the browsers of other visitors and, in versions 0.5.0 and 0.5.1, also in administrator moderation sessions, potentially leading to session hijacking or other XSS impacts.

The vulnerability allows unauthenticated attackers to inject and execute arbitrary HTML or script code in the browsers of other users visiting the guestbook page. This can lead to theft of session cookies, defacement, or other malicious actions executed in the context of the victim's browser. Administrator sessions in versions 0.5.0 and 0.5.1 are also vulnerable during moderation, increasing the risk of administrative compromise.

Upgrade the Grav Guestbook plugin to version 0.5.2 or later, where this vulnerability has been fixed. There is no indication of alternative mitigations or temporary workarounds. Patch status is confirmed by the version range affected and fixed in 0.5.2.