Getgrav Grav-Plugin-Guestbook vulnerabilities

2 CVEs affecting Getgrav Grav-Plugin-Guestbook, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-109322, published 2026-10-12.

More from Getgrav.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-109319, published 2026-10-12. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin…
• CVE-2026-109322, published 2026-10-12. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as…