wpDiscuz vulnerabilities

The Comments – wpDiscuz plugin for WordPress up to version 7.6.56 is vulnerable to Stored Cross-Site Scripting. The vulnerability exists in the getCommentAuthor() function, which fails to properly escape the guest commenter 'Website' field before inserting it into single-quoted HTML attributes. This allows unauthenticated attackers to inject arbitrary scripts that execute when users view affected pages.

Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz (up to 7.6.43) allows exploiting incorrectly configured access control security levels.

The wpDiscuz plugin up to version 7.6.33 has a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects the plugin's authorization mechanism.