Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: getgrav grav-plugin-guestbook 0.5.2 Clear all filters
TI-2026-71138 CVE-2026-109322 · GHSA-44rc-569f-hxfg

Stored XSS in Grav Guestbook via AJAX pagination and admin views

Priority LOW 23

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQ…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.002 Published 2026-10-12 Fixed in 0.5.2 CWE-79
TI-2026-71135 CVE-2026-109319 · GHSA-6xrw-24fx-4qcf

Missing authorization and CSRF in Grav Guestbook moderation actions

Priority LOW 23

Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00201 Published 2026-10-12 Fixed in 0.5.2 CWE-862