PT-2026-25138 · Gvectors · Wpdiscuz

Scott Moore · Publicado 2026-03-13 · Atualizado 2026-03-13 · CVE-2026-22183

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47

Description wpDiscuz contains a stored cross-site scripting issue in the inline comment preview functionality. Authenticated users can inject malicious scripts by submitting comments with unescaped content. Attackers with unfiltered html capabilities can inject JavaScript directly through comment content rendered in the AJAX response from the getLastInlineComments() function in class WpdiscuzHelperAjax.php due to a lack of proper HTML escaping.

Recommendations Update wpDiscuz to version 7.6.47 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-22183

Produtos afetados

Wpdiscuz

Referências · 6

• https://wordpress.org/plugins/wpdiscuz/#developers · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-22183 · Nota de Segurança
• https://t.me/CVEtracker/47322 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2032410937798660314 · Publicação no Twitter
• https://vulncheck.com/advisories/wpdiscuz-before-stored-cross-site-scripting-in-inline-comment-preview · Nota
• https://wordpress.org/plugins/wpdiscuz · Nota