Gwolle Guestbook EUVD-2026-102652

Exploitation requires that the Gwolle Guestbook plugin (version ≤5.1.1) be installed and active on a WordPress site, and that an attacker-controlled value in the 'permalink' parameter be reflected by the plugin's frontend permalink handling (gb-permalink.php). No authentication is needed (PR:N), but exploitation is GATED on victim user interaction (UI:R): a target must click or load the attacker's crafted link for the injected script to execute. This is a reflected (non-persistent) XSS, so there is no stored payload - each victim must be individually lured, and the payload runs only with the privileges of whatever session the victim already holds. Impact is limited to the victim's browser context; it does not by itself grant server-side access.

This is a reflected cross-site scripting (CWE-79) flaw rated CVSS 6.1 (Medium). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N confirms a network-exploitable, low-complexity bug that requires NO privileges (PR:N, unauthenticated) but DOES require victim user interaction (UI:R) - the attacker must trick a user into clicking a crafted link carrying a malicious 'permalink' parameter. The scope-changed flag (S:C) reflects script execution crossing from the vulnerable plugin into the victim's browser session, with limited confidentiality and integrity impact (C:L/I:L) and no availability impact. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. The CVE is NOT on CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation or weaponization. In practice this is a typical mid-severity reflected XSS: real but not an emergency. The reliance on social engineering (UI:R) and the absence of KEV/POC signals place it well below network-unauthenticated no-interaction criticals. Priority should be driven by whether the Gwolle Guestbook plugin is actually installed and internet-facing, not by raw severity alone.

An unauthenticated attacker crafts a URL to a WordPress site running Gwolle Guestbook with a malicious script embedded in the 'permalink' parameter, then delivers it via phishing email, social media, or a malicious page. When a logged-in administrator or visitor clicks the link, the unsanitized parameter is reflected into the page and the attacker's JavaScript executes in their browser session. No public proof-of-concept is referenced in the provided data; given AV:N/AC:L the request itself is trivial to construct, but UI:R means success depends on luring a victim to click.