Gwolle Guestbook <= 5.1.1 - Unauthenticated Reflected Cross-Site Scripting via 'permalink' Parameter
- ID
- WPSEC-2026-0997
- Plugin
- Gwolle Guestbook (gwolle-gb)
- Affected
- all versions before 5.1.2
- Remediation
- Update to 5.1.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-15
- Attack surface
- Gwolle Guestbook on WPSec AttackSurface
- Fix released
- Published
Description
The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' POST parameter in all versions up to, and including, 5.1.1. This is due to the entry permalink metabox line, rendered by AJAX actions available to unauthenticated users such as gwolle_gb_infinite_scroll, taking the permalink from $_POST, sanitizing it only with sanitize_text_field(), and printing it in a link href with esc_attr() instead of esc_url(), which does not block dangerous URL schemes such as javascript:. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action such as submitting a crafted form and clicking the injected link.
References
- https://wpsec.com/vuln/WPSEC-2026-0997/
- https://plugins.svn.wordpress.org/gwolle-gb/tags/5.1.2/
- https://wordpress.org/plugins/gwolle-gb/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS