CVE-2026-103481 mpol CVE debrief

Who should care

WordPress site administrators and security teams who use the Gwolle Guestbook plugin should assess their exposure and take steps to mitigate the vulnerability. This includes verifying plugin versions, reviewing configurations, and applying patches or updates as soon as available. Additionally, security teams should monitor for suspicious activity and potential attacks targeting the Gwolle Guestbook plugin, and review compensating controls for exposed

Why it matters

The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting, allowing unauthenticated attackers to inject arbitrary web scripts. WordPress site administrators and security teams should assess exposure and apply patches or mitigations as soon as available.

• Reflected Cross-Site Scripting attacks could lead to unauthorized script injection and potential user exploitation.
• Successful attacks may result in malicious scripts being executed in user browsers, potentially leading to further security issues.
• The vulnerability requires user interaction to exploit, but could have significant consequences if successfully executed.
• Verification of plugin versions and exposure is necessary to prioritize remediation efforts.

Technical summary

The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Defensive priority

Medium priority for WordPress site administrators and security teams to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure of WordPress sites using the Gwolle Guestbook plugin, versions up to and including 5.1.1.
• Verify if the 'permalink' parameter is being used in a way that could allow Reflected Cross-Site Scripting attacks.
• Apply patches or updates to the Gwolle Guestbook plugin as soon as available.
• Monitor for suspicious activity or potential attacks targeting the Gwolle Guestbook plugin.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 6.1 and MEDIUM severity. The Gwolle Guestbook plugin is affected by a Reflected Cross-Site Scripting vulnerability via the 'permalink' parameter.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.