Marcel Pol’s Gwolle Guestbook WordPress plugin contains a reflected XSS flaw in which user‑supplied data is included in a generated page without proper encoding. This improper neutralization can cause a malicious script to execute in any browser that renders the affected page. The vulnerability is categorized as CWE‑79, indicating that the input is not safely handled during web page generation.

The flaw affects all releases of the Gwolle Guestbook plugin through version 4.7.1 inclusive. Site owners who have installed this plugin on their WordPress installations and have not upgraded beyond the affected threshold are at risk.

The CVSS score of 7.1 signals high severity. The EPSS score of less than 1% indicates a low current probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, a likely attack would involve an attacker crafting a URL containing malicious input that is reflected back into the guestbook output; the victim’s browser would need to load this URL, and no authentication or privilege escalation is required. These attack‑vector details are inferred from typical reflected XSS behavior because the CVE description does not explicitly state them.