---
id: "CVE-2026-103481"
kind: "vulnerability"
aliases: ["CVE-2026-103481"]
title: "Gwolle Guestbook WordPress plugin: reflected XSS via permalink parameter"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wordpress-plugins"]
not_affected_if: ["plugin-deactivated", "plugin-not-installed"]
published_at: "2026-10-16T05:17:28+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T04:04:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103481", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Gwolle Guestbook WordPress plugin: reflected XSS via permalink parameter

The Gwolle Guestbook plugin for WordPress does not sanitize the 'permalink' parameter, so a crafted link can inject script into a page. An attacker who tricks a user into clicking the link can run JavaScript in that user's browser session on the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Gwolle Guestbook version in the WordPress admin plugin list or with `wp plugin get gwolle-gb --field=version`
- Confirm whether the plugin is active with `wp plugin list --status=active`

## Fix

- Update Gwolle Guestbook to a version later than `5.1.1` once the plugin author publishes a fixed release (unknown whether one is available in the sources)
- Until patched, deactivate the plugin if guestbook features are not needed

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103481

## From the sources

The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_