CVE-2026-109322: Grav Guestbook Plugin XSS Vulnerability

CVE-2026-109322 Overview

CVE-2026-109322 is a stored cross-site scripting (XSS) vulnerability in the Grav Guestbook plugin before version 0.5.2. The plugin's AJAX Load more handler and the Admin Load all handler insert stored author and message fields into the DOM as unescaped HTML through jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers. In plugin versions 0.5.0 and 0.5.1, the injected markup also executes within administrator moderation sessions, extending the impact to privileged users. The flaw is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in both visitor and administrator browser sessions on affected Grav sites.

Affected Products

Grav Guestbook plugin versions before 0.5.2
Grav Guestbook plugin 0.5.0 (administrator moderation sessions impacted)
Grav Guestbook plugin 0.5.1 (administrator moderation sessions impacted)

Discovery Timeline

2026-10-12 - CVE-2026-109322 published to NVD
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-109322

Vulnerability Analysis

The Grav Guestbook plugin accepts guestbook submissions from unauthenticated visitors and renders them back to subsequent viewers. Submission content, specifically the author and message fields, is persisted and later retrieved through two AJAX endpoints: the public Load more pagination handler and the Admin Load all moderation view.

Both handlers return stored entries to the browser, where client-side JavaScript inserts the field values into the DOM using jQuery methods that interpret HTML. Because the input is not neutralized before insertion, attacker-supplied markup becomes active page content. Script payloads execute under the origin of the Grav site, allowing session token theft, forced navigation, drive-by downloads, and arbitrary DOM manipulation.

In plugin versions 0.5.0 and 0.5.1, the Admin Load all view renders the same unescaped values during moderation, so administrators reviewing pending entries trigger execution within their authenticated admin session.

Root Cause

The vulnerability stems from the use of jQuery HTML insertion sinks, such as .html(), to populate the author and message fields rather than text-only methods like .text(). Stored input traverses the pipeline from submission to render without server-side encoding or client-side escaping. The CWE-79 classification reflects missing output neutralization at the DOM boundary.

Attack Vector

An unauthenticated attacker submits a guestbook entry whose author or message field contains HTML with an executable payload, for example an event handler on an image tag or an inline script container. The entry is stored by the plugin. When another visitor loads additional entries through the AJAX Load more control, the handler fetches the stored record and injects it into the page as HTML, triggering execution. On vulnerable admin versions, the same payload executes when an administrator opens the moderation Load all view.

The vulnerability requires user interaction, specifically a victim loading guestbook content or an admin opening moderation. Attack complexity is low and no privileges are needed to plant the payload.

See the GitHub Security Advisory GHSA-jgpj-gchm-6j29 and the VulnCheck Advisory on Grav XSS for additional context.

Detection Methods for CVE-2026-109322

Indicators of Compromise

Guestbook entries containing HTML tags such as <script>, <img onerror=>, <svg onload=>, or <iframe> in the author or message fields.
Outbound requests from visitor or admin browsers to unexpected domains shortly after loading guestbook pages or the admin moderation view.
Admin session cookies or CSRF tokens appearing in web server access logs for external referrers.
Stored entries with abnormally long author field values or encoded JavaScript payloads such as <script> sequences.

Detection Strategies

Query the Grav data store or filesystem for guestbook entries whose fields contain <, >, javascript:, or on event handler prefixes.
Inspect web server logs for POST requests to the guestbook submission endpoint with suspicious payload bodies.
Monitor AJAX responses from Load more and admin Load all endpoints for HTML characters in author or message JSON fields.
Deploy a Content Security Policy (CSP) with reporting enabled to surface inline script execution originating from guestbook pages.

Monitoring Recommendations

Alert on administrator sessions generating unexpected outbound XHR or fetch requests after visiting guestbook moderation views.
Track submission rate anomalies on the guestbook endpoint from single source IPs to flag payload probing.
Centralize web server, application, and endpoint telemetry so XSS exploitation chains can be reconstructed across visitor and admin activity.

How to Mitigate CVE-2026-109322

Immediate Actions Required

Upgrade the Grav Guestbook plugin to version 0.5.2 or later on all Grav installations.
Audit existing guestbook entries for stored HTML or script payloads and remove or sanitize any suspicious records before administrators open moderation views.
Rotate administrator credentials and invalidate active admin sessions if versions 0.5.0 or 0.5.1 were used in production.
Restrict public submission to the guestbook endpoint behind a web application firewall rule that blocks HTML tags in form fields until patching is complete.

Patch Information

The maintainers resolved the issue in Grav Guestbook plugin version 0.5.2. The fix ensures that stored author and message fields are rendered as text rather than HTML in both the public AJAX pagination handler and the administrator moderation view. Refer to the GitHub Security Advisory GHSA-jgpj-gchm-6j29 for upgrade guidance.

Workarounds

Disable the Guestbook plugin from the Grav admin panel until the upgrade to 0.5.2 is applied.
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources on pages that render guestbook content.
Require administrator authentication or CAPTCHA before accepting guestbook submissions to reduce unauthenticated payload planting.