CVE-2026-9148
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
The Comments – wpDiscuz plugin for WordPress up to version 7.6.56 is vulnerable to Stored Cross-Site Scripting. The vulnerability exists in the getCommentAuthor() function, which fails to properly escape the guest commenter 'Website' field before inserting it into single-quoted HTML attributes. This allows unauthenticated attackers to inject arbitrary scripts that execute when users view affected pages.
Risk Assessment
The organization faces risks of session hijacking, redirection to malicious sites, and theft of sensitive data. The attack requires no authentication, increasing the likelihood of widespread exploitation.
Recommendation
Immediately update the Comments – wpDiscuz plugin to version 7.6.57 or later. If an update is not possible, temporarily disable the plugin until the patch is applied.
Other vulnerabilities in wpDiscuz
See all- CVE-2026-119366High
The wpDiscuz plugin by AdvancedCoding up to 7.6.73 does not properly neutralize input during web page generation, allowing a Stored XSS attack. The issue affects versions from n/a through 7.6.73.
- CVE-2025-68997Medium
Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz (up to 7.6.43) allows exploiting incorrectly configured access control security levels.
- CVE-2025-59591Medium
The wpDiscuz plugin up to version 7.6.33 has a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects the plugin's authorization mechanism.
Original NVD description (English source)
The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the guest commenter 'Website' field in versions up to, and including, 7.6.56 This is due to insufficient output escaping in the getCommentAuthor() function, which interpolates the stored comment_author_url value directly into single-quoted HTML attributes without applying esc_url() or esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS