PT-2026-2166 · Voltronic Power+1 · Snmp Web Pro+1

Jean-Marie Bourbon + 2 · Publicado 2026-01-09 · Atualizado 2026-04-22 · CVE-2026-22192

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47

Description The software contains a stored cross-site scripting issue that permits authenticated attackers to inject malicious JavaScript. This is achieved by importing a specially crafted options file containing unescaped custom CSS field values. Attackers can provide a malicious JSON import file with script payloads within the customCss parameter. These payloads execute on every page when rendered through the options handler due to insufficient sanitization.

Recommendations Update wpDiscuz to version 7.6.47 or later.

Exploit

Correção

XSS

Missing Authentication

Enumeração de Fraquezas

CWE-79

CWE-306

Identificadores relacionados

CVE-2026-22192

Produtos afetados

Snmp Web Pro

Wpdiscuz

Referências · 12

• 🔥 https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22192-22199_Voltronic-Power_Preauth_root_RCE.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-22192 · Nota de Segurança
• https://voltronicpower.com · Nota
• https://vulncheck.com/advisories/wpdiscuz-before-stored-cross-site-scripting-via-malicious-options-import · Nota
• https://twitter.com/kmkz_security/status/2046884750552404446 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2032410936057999681 · Publicação no Twitter
• https://t.me/CVEtracker/47319 · Publicação no Telegram
• https://twitter.com/kmkz_security/status/2009579940342272377 · Publicação no Twitter
• https://wordpress.org/plugins/wpdiscuz · Nota
• https://vulncheck.com/advisories/voltronic-power-snmp-web-pro-authentication-bypass-via-localstorage · Nota
• https://boffsec-services.com/posts/sicuroweb-cve-2026-22191 · Nota
• https://wordpress.org/plugins/wpdiscuz/#developers · Correção