PT-2026-55508 · WordPress · Wpdiscuz

Mickeyjoe · Published 2026-07-03 · Updated 2026-07-03 · CVE-2026-9148

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.57

Description Stored Cross-Site Scripting occurs when the plugin fails to properly escape output in the getCommentAuthor() function. This happens because the comment author url value, provided in the guest commenter Website field, is interpolated directly into single-quoted HTML attributes without using esc url() or esc attr(). An unauthenticated attacker can submit a crafted comment containing a malicious payload in the Website field, which is then stored and executed in the browser of any user, including administrators, who views the affected page. This can lead to session hijacking, account takeover, and content manipulation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-9148

Affected Products

Wpdiscuz

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2026-9148 · Security Note
• https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.48/forms/wpdFormAttr/Tools/Sanitizer.php#L14 · Note
• https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.48/utils/class.WpdiscuzHelper.php#L1619 · Note
• https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.54/utils/class.WpdiscuzHelper.php#L1619 · Note
• https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.48/utils/class.WpdiscuzHelper.php#L1615 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f509f1c6-6094-434d-8e70-ad8419250aa2?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.54/forms/wpdFormAttr/Tools/Sanitizer.php#L14 · Note
• https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.54/forms/wpdFormAttr/Field/DefaultField/Website.php#L119 · Note
• https://twitter.com/UpwindMDR/status/2073008744347169011 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.48/forms/wpdFormAttr/Field/DefaultField/Website.php#L119 · Note
• https://plugins.trac.wordpress.org/changeset/3563675/wpdiscuz/trunk/utils/class.WpdiscuzHelper.php · Note
• https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.54/utils/class.WpdiscuzHelper.php#L1615 · Note
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fwpdiscuz/tags/7.6.56&new_path=%2Fwpdiscuz/tags/7.6.57 · Note