Advanced Guestbook 2.4.4 contains a persistent cross‑site scripting flaw in the smilies administration interface that allows authenticated administrators to inject JavaScript by manipulating the s_emotion parameter; a malicious script that is stored will execute whenever the smilies tab is viewed, which can lead to arbitrary code execution in the context of the administrator’s browser. The CVE description does not specify the exact downstream effects of this execution, but the ability to run JavaScript grants potential control over the admin interface, which could be used for data exfiltration or site tampering, an inference derived from the nature of the flaw.

The vulnerability affects installations of Advanced Guestbook version 2.4.4 provided by AmpPS that expose the smilies administration page; only systems that allow authenticated administrators to edit smilies entries are at risk.

The CVSS score of 5.1 indicates moderate severity; the exploit requires authenticated access to the admin interface, limiting public exploitability; EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog; exploitation would necessitate one administrator unknowingly submitting malicious content and another administrator viewing the smilies tab.