{
 "id": "WPSEC-2026-0997",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0997/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0997/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0997/index.md",
 "title": "Gwolle Guestbook <= 5.1.1 - Unauthenticated Reflected Cross-Site Scripting via 'permalink' Parameter",
 "description": "The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' POST parameter in all versions up to, and including, 5.1.1. This is due to the entry permalink metabox line, rendered by AJAX actions available to unauthenticated users such as gwolle_gb_infinite_scroll, taking the permalink from $_POST, sanitizing it only with sanitize_text_field(), and printing it in a link href with esc_attr() instead of esc_url(), which does not block dangerous URL schemes such as javascript:. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action such as submitting a crafted form and clicking the injected link.",
 "plugin": {
  "slug": "gwolle-gb",
  "name": "Gwolle Guestbook",
  "full_name": "Gwolle Guestbook",
  "wordpress_org": "https://wordpress.org/plugins/gwolle-gb/",
  "advisories_url": "https://wpsec.com/vuln/plugin/gwolle-gb/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/gwolle-gb"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.1.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.1.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.1.2",
 "remediation": "Update to 5.1.2 or later.",
 "fix_released": "2026-10-14T09:20:12+00:00",
 "published": "2026-10-15T09:43:22+00:00",
 "updated": "2026-10-14T14:18:08.645040+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0997/",
  "https://plugins.svn.wordpress.org/gwolle-gb/tags/5.1.2/",
  "https://wordpress.org/plugins/gwolle-gb/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/gwolle-gb",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-15"
 }
}