CVE-2025-5807: Gwolle Guestbook <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting via `gwolle_gb_content` Parameter
The Gwolle Guestbook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘gwollegbcontent’ parameter in all versions up to, and including, 4.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5807?
CVE-2025-5807 has been classified as a medium severity vulnerability due to potential exploitation by unauthenticated attackers.
How do I fix CVE-2025-5807?
To resolve CVE-2025-5807, update the Gwolle Guestbook plugin to version 4.9.3 or later, which contains the necessary security patches.
What type of vulnerability is CVE-2025-5807?
CVE-2025-5807 is a Stored Cross-Site Scripting (XSS) vulnerability originating from inadequate input validation.
Which versions of Gwolle Guestbook are affected by CVE-2025-5807?
CVE-2025-5807 affects all versions of Gwolle Guestbook up to and including 4.9.2.
Can CVE-2025-5807 be exploited without authentication?
Yes, CVE-2025-5807 can be exploited by unauthenticated attackers, making it a significant security risk.