# wpDiscuz <= 7.6.73 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

- **ID:** WPSEC-2026-2055
- **Plugin:** Comments – wpDiscuz (`wpdiscuz`), https://wordpress.org/plugins/wpdiscuz/
- **Affected versions:** all versions before 7.6.74
- **Fixed in:** 7.6.74 (Update to 7.6.74 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpdiscuz
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2055/

## Description

The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment author name in all versions up to, and including, 7.6.73. This is due to the comment walker filling comment templates with sequential str_replace() calls. A template placeholder such as {TEXT} in a commenter's name, which is printed in places like the avatar alt attribute, is expanded again into the comment's HTML, which breaks the attribute context. The reply-to author name is also output without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user, including a moderator viewing a pending comment, accesses an affected page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2055/
- https://plugins.svn.wordpress.org/wpdiscuz/tags/7.6.74/
- https://wordpress.org/plugins/wpdiscuz/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2055/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.