The Gwolle Guestbook plugin for WordPress is vulnerable to a reflected Cross‑Site Scripting flaw via the 'permalink' parameter. The issue arises from inadequate input sanitization and the lack of proper output escaping, allowing an attacker to inject arbitrary JavaScript that is reflected back in the browser when a victim follows a crafted link. This type of vulnerability can be used for session hijacking, credential theft, malicious redirection, or phishing attacks against unsuspecting site visitors, but it does not provide direct remote code execution on the server.

The flaw affects all released versions of the Gwolle Guestbook plugin up to and including version 5.1.1. The vulnerability resides in files such as frontend/gb-permalink.php and frontend/gb-ajax-infinite-scroll.php. Users deploying any of these versions on their WordPress sites are therefore at risk.

The CVSS base score of 6.1 indicates a moderate severity. While no EPSS score is available and the issue is not listed in the CISA KEV catalog, the attack vector is client‑side: an attacker only needs to craft a malicious URL and convince an end‑user to click it. Successful exploitation requires no authentication and occurs during normal browsing, meaning that any visitor to the affected site is a potential target. The flaw qualifies as a typical reflected XSS scenario, with moderate impact to confidentiality and integrity of user sessions.