CVE-2026-103481
Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
| CWE | CWE-79 |
| Vendor | mpol |
| Product | gwolle guestbook |
| Published | Oct 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for mpol gwolle guestbook
Be the first to know when new medium vulnerabilities affecting mpol gwolle guestbook are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
mpol / Gwolle Guestbook
0 ≤ 5.1.1
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/d8eff266-43fe-4636-b4ef-c973db7e7952?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-permalink.php#L28 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-permalink.php#L21 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/gwolle-gb/tags/5.1.1/frontend/gb-ajax-infinite-scroll.php#L96 codeberg.org: https://codeberg.org/cyclotouriste/gwolle-gb/commit/f6e483654b56188a3fa208fd18a4f0468577a825
Credits
crow