PT-2026-25146 · Gvectors · Wpdiscuz

Scott Moore · Publicado 2026-03-13 · Atualizado 2026-03-13 · CVE-2026-22210

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47

Description The software contains a cross-site scripting issue that allows attackers to inject malicious code. This is achieved through unescaped attachment URLs in HTML output, specifically by exploiting the WpdiscuzHelperUpload class. Attackers can create malicious attachment records or utilize filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, leading to code execution within the context of WordPress users viewing comments.

Recommendations Update wpDiscuz to version 7.6.47 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-22210

Produtos afetados

Wpdiscuz

Referências · 6

• https://wordpress.org/plugins/wpdiscuz/#developers · Correção
• https://wordpress.org/plugins/wpdiscuz · Nota
• https://vulncheck.com/advisories/wpdiscuz-before-cross-site-scripting-via-unescaped-attachment-urls · Nota
• https://twitter.com/CVEnew/status/2032410928860590478 · Publicação no Twitter
• https://t.me/CVEtracker/47318 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-22210 · Nota de Segurança