# Gwolle Guestbook <= 5.1.1 - Unauthenticated Reflected Cross-Site Scripting via 'permalink' Parameter

- **ID:** WPSEC-2026-0997
- **Plugin:** Gwolle Guestbook (`gwolle-gb`), https://wordpress.org/plugins/gwolle-gb/
- **Affected versions:** all versions before 5.1.2
- **Fixed in:** 5.1.2 (Update to 5.1.2 or later.)
- **Severity:** Medium 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/gwolle-gb
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0997/

## Description

The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' POST parameter in all versions up to, and including, 5.1.1. This is due to the entry permalink metabox line, rendered by AJAX actions available to unauthenticated users such as gwolle_gb_infinite_scroll, taking the permalink from $_POST, sanitizing it only with sanitize_text_field(), and printing it in a link href with esc_attr() instead of esc_url(), which does not block dangerous URL schemes such as javascript:. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can successfully trick a user into performing an action such as submitting a crafted form and clicking the injected link.

## References

- https://wpsec.com/vuln/WPSEC-2026-0997/
- https://plugins.svn.wordpress.org/gwolle-gb/tags/5.1.2/
- https://wordpress.org/plugins/gwolle-gb/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0997/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.