{"id":"CVE-2026-103481","kind":"vulnerability","aliases":["CVE-2026-103481"],"related":[],"title":"Gwolle Guestbook WordPress plugin: reflected XSS via permalink parameter","description":"The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.","summary":"The Gwolle Guestbook plugin for WordPress does not sanitize the 'permalink' parameter, so a crafted link can inject script into a page. An attacker who tricks a user into clicking the link can run JavaScript in that user's browser session on the site.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["plugin-deactivated","plugin-not-installed"],"how_to_check":"- Check the installed Gwolle Guestbook version in the WordPress admin plugin list or with `wp plugin get gwolle-gb --field=version`\n- Confirm whether the plugin is active with `wp plugin list --status=active`","fix":"- Update Gwolle Guestbook to a version later than `5.1.1` once the plugin author publishes a fixed release (unknown whether one is available in the sources)\n- Until patched, deactivate the plugin if guestbook features are not needed","status":"open","published_at":"2026-10-16T05:17:28+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T04:04:22+00:00","updated_at":"2026-10-25T04:04:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:04:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update Gwolle Guestbook to a version later than `5.1.1` once the plugin author publishes a fixed release (unknown whether one is available in the sources)\n- Until patched, deactivate the plugin if guestbook features are not needed","reach":"internet","title":"Gwolle Guestbook WordPress plugin: reflected XSS via permalink parameter","impact":"medium","summary":"The Gwolle Guestbook plugin for WordPress does not sanitize the 'permalink' parameter, so a crafted link can inject script into a page. An attacker who tricks a user into clicking the link can run JavaScript in that user's browser session on the site.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Script runs in a visitor's browser on the site after a click","analyst_note":"Confirm the fixed version and whether a patch exists, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-103481 and the plugin's WordPress.org changelog.","how_to_check":"- Check the installed Gwolle Guestbook version in the WordPress admin plugin list or with `wp plugin get gwolle-gb --field=version`\n- Confirm whether the plugin is active with `wp plugin list --status=active`","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-deactivated"],"who_is_affected":"Sites running the Gwolle Guestbook plugin version 5.1.1 or earlier are exposed. Sites that do not have the plugin installed or active can skip it, and the sources do not say whether the vulnerable parameter is reachable under particular settings.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000658,"input_tokens":3372,"output_tokens":641,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-103481':12A,15A '-2026':11A,14A '5.1.1':93C 'action':128C 'arbitrari':111C 'attack':47B,108C 'browser':63B 'click':53B,131C 'craft':38B 'cross':79C 'cross-sit':78C 'cve':10A,13A 'due':94C 'escap':101C 'execut':117C 'guestbook':2A,26B,70C 'gwoll':1A,25B,69C 'host':19B 'includ':92C 'inject':41B,110C 'input':97C 'insuffici':96C 'javascript':58B 'link':39B,55B,134C 'make':103C 'output':100C 'packag':16B 'page':45B,115C 'paramet':9A,35B,85C 'perform':126C 'permalink':8A,34B,84C 'plugin':4A,23B,27B,71C 'possibl':105C 'reflect':5A,77C 'run':57B 'sanit':32B,98C 'script':42B,81C,113C 'self':18B 'self-host':17B 'session':64B 'site':67B,80C 'success':121C 'trick':49B,122C 'unauthent':107C 'user':51B,61B,124C 'version':88C 'via':7A,82C 'vulner':75C 'web':112C 'wordpress':3A,20B,22B,29B,73C 'wordpress-plugin':21B 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Gwolle Guestbook plugin version 5.1.1 or earlier are exposed. Sites that do not have the plugin installed or active can skip it, and the sources do not say whether the vulnerable parameter is reachable under particular settings.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T05:17:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103481","severity":null,"published_at":"2026-10-16T05:17:28+00:00","modified_at":"2026-10-16T15:17:02+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}