CVE-2026-119366
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The wpDiscuz plugin by AdvancedCoding up to 7.6.73 does not properly neutralize input during web page generation, allowing a Stored XSS attack. The issue affects versions from n/a through 7.6.73.
Risk Assessment
An attacker could persistently store malicious script that executes in the browsers of users visiting the site. This may lead to session or credential theft or takeover of administrator accounts.
Recommendation
Update the wpDiscuz plugin to a version later than 7.6.73. Additionally, deploy security headers such as Content-Security-Policy.
Other vulnerabilities in wpDiscuz
See all- CVE-2026-9148High
The Comments – wpDiscuz plugin for WordPress up to version 7.6.56 is vulnerable to Stored Cross-Site Scripting. The vulnerability exists in the getCommentAuthor() function, which fails to properly escape the guest commenter 'Website' field before inserting it into single-quoted HTML attributes. This allows unauthenticated attackers to inject arbitrary scripts that execute when users view affected pages.
- CVE-2025-68997Medium
Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz (up to 7.6.43) allows exploiting incorrectly configured access control security levels.
- CVE-2025-59591Medium
The wpDiscuz plugin up to version 7.6.33 has a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects the plugin's authorization mechanism.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.73.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS