Getgrav Grav Plugin Guestbook vulnerabilities

2 vulnerabilities

Known vulnerabilities in Getgrav Grav Plugin Guestbook, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3CVE-2026-109319getgravgrav-plugin-guestbook
EPSS score
0.20%
Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce-less GET requests, can delete or approve Guestbook entries.6.1CVE-2026-109322getgravgrav-plugin-guestbook
EPSS score
0.20%
Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions.