Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-22183

wpDiscuz before 7.6.47 - Stored Cross-Site Scripting in Inline Comment Preview

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inject malicious scripts by submitting comments with unescaped content. Attackers with unfiltered_html capabilities can inject JavaScript directly through comment content rendered in the AJAX response from the getLastInlineComments() function in class.WpdiscuzHelperAjax.php without proper HTML escaping.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

gVectors wpDiscuz

Default version status: unaffected

  • 0 to < 7.6.47affected
  • 7.6.47unaffected
pkg:wordpress-plugin/wpdiscuz

References