CVE-2026-22183
wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inject malicious scripts by submitting comments with unescaped content. Attackers with unfiltered_html capabilities can inject JavaScript directly through comment content rendered in the AJAX response from the getLastInlineComments() function in class.WpdiscuzHelperAjax.php without proper HTML escaping.
- Score
- CVSS 3.1 6.1 Medium
- Status
- Analyzed - disclosure@vulncheck.com
- Published
- 2026-03-13
- Last modified
- 2026-03-13
- Weaknesses
- CWE-79
Affected products
References
- https://wordpress.org/plugins/wpdiscuz/
- https://wordpress.org/plugins/wpdiscuz/#developers
- https://www.vulncheck.com/advisories/wpdiscuz-before-stored-cross-site-scripting-in-inline-comment-preview
