Live › vulnerability › CVE-2026-103481
Go to dashboardThe Gwolle Guestbook plugin for WordPress does not sanitize the 'permalink' parameter, so a crafted link can inject script into a page. An attacker who tricks a user into clicking the link can run JavaScript in that user's browser session on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Gwolle Guestbook plugin version 5.1.1 or earlier are exposed. Sites that do not have the plugin installed or active can skip it, and the sources do not say whether the vulnerable parameter is reachable under particular settings.
No product ranges from the sources yet.
wp plugin get gwolle-gb --field=versionwp plugin list --status=active5.1.1 once the plugin author publishes a fixed release (unknown whether one is available in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
This page as .md · .json · in your agent: get_signal("CVE-2026-103481")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.