The Grav Guestbook plugin before 0.5.2 has a stored cross‑site scripting issue. The AJAX Load more and Admin Load all handlers insert the author and message fields into the page using jQuery without escaping, allowing an unauthenticated visitor to store malicious markup that runs in other users’ browsers. In plugin versions 0.5.0 and 0.5.1, the same flaw is also exploitable during administrator moderation sessions.

The vulnerability affects the Grav Guestbook plugin from the getgrav vendor, specifically any deployment using versions 0.5.0 through 0.5.1. Versions earlier than 0.5.0 or 0.5.2 and later are not impacted.

The CVSS score of 5.3 indicates a moderate severity, and the issue is classically a stored XSS that does not require authentication to inject the payload. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is most likely through the untrusted AJAX input that stores user‑supplied author and message data, which is later rendered without proper escaping.