PT-2026-25138 · Gvectors · Wpdiscuz

Scott Moore · Published 2026-03-13 · Updated 2026-03-13 · CVE-2026-22183

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47

Description wpDiscuz contains a stored cross-site scripting issue in the inline comment preview functionality. Authenticated users can inject malicious scripts by submitting comments with unescaped content. Attackers with unfiltered html capabilities can inject JavaScript directly through comment content rendered in the AJAX response from the getLastInlineComments() function in class WpdiscuzHelperAjax.php due to a lack of proper HTML escaping.

Recommendations Update wpDiscuz to version 7.6.47 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-22183

Affected Products

Wpdiscuz

References · 6

• https://wordpress.org/plugins/wpdiscuz/#developers · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22183 · Security Note
• https://t.me/CVEtracker/47322 · Telegram Post
• https://twitter.com/CVEnew/status/2032410937798660314 · Twitter Post
• https://vulncheck.com/advisories/wpdiscuz-before-stored-cross-site-scripting-in-inline-comment-preview · Note
• https://wordpress.org/plugins/wpdiscuz · Note