PT-2026-2166 · Voltronic Power+1 · Snmp Web Pro+1

Jean-Marie Bourbon + 2 · Published 2026-01-09 · Updated 2026-04-22 · CVE-2026-22192

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47

Description The software contains a stored cross-site scripting issue that permits authenticated attackers to inject malicious JavaScript. This is achieved by importing a specially crafted options file containing unescaped custom CSS field values. Attackers can provide a malicious JSON import file with script payloads within the customCss parameter. These payloads execute on every page when rendered through the options handler due to insufficient sanitization.

Recommendations Update wpDiscuz to version 7.6.47 or later.

Exploit

Fix

Missing Authentication

XSS

Weakness Enumeration

CWE-306

CWE-79

Related Identifiers

CVE-2026-22192

Affected Products

Snmp Web Pro

Wpdiscuz

References · 12

• 🔥 https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22192-22199_Voltronic-Power_Preauth_root_RCE.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-22192 · Security Note
• https://wordpress.org/plugins/wpdiscuz/#developers · Patch
• https://vulncheck.com/advisories/wpdiscuz-before-stored-cross-site-scripting-via-malicious-options-import · Note
• https://twitter.com/kmkz_security/status/2046884750552404446 · Twitter Post
• https://vulncheck.com/advisories/voltronic-power-snmp-web-pro-authentication-bypass-via-localstorage · Note
• https://twitter.com/kmkz_security/status/2009579940342272377 · Twitter Post
• https://twitter.com/CVEnew/status/2032410936057999681 · Twitter Post
• https://boffsec-services.com/posts/sicuroweb-cve-2026-22191 · Note
• https://wordpress.org/plugins/wpdiscuz · Note
• https://voltronicpower.com · Note
• https://t.me/CVEtracker/47319 · Telegram Post