CVE-2026-103481

MediumCVSS 6.1/10Last modified Oct 16, 2026

Description

The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 16, 2026
Last modified
Oct 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1034825.4The Simple Newsletter Plugin – Noptin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noptin_fields[<custom_fieldCVE-2026-1034848.8IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.CVE-2026-1034887.1In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access reCVE-2026-1034895.4In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possibleCVE-2026-1034907.2In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group linksCVE-2026-1034916.5In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issuesCVE-2026-1034926.5In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachmentsCVE-2026-1034938.1In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possibleCVE-2026-1034946.6In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changesCVE-2026-1034954.3In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogsCVE-2026-1034965.4In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notificationsCVE-2026-1034975.5In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
CVE-2026-103481: Medium severity, CVSS 6.1 | Vulnix