Comments – wpDiscuz <= 7.6.75 - Unauthenticated Stored Cross-Site Scripting via Comment Image URL Conversion
- ID
- WPSEC-2026-3063
- Plugin
- Comments – wpDiscuz (wpdiscuz)
- Affected
- all versions before 7.7.0
- Remediation
- Update to 7.7.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- Comments – wpDiscuz on WPSec AttackSurface
- Fix released
- Published
Description
The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image URL to <img> conversion applied to comment content in all versions up to, and including, 7.6.75 due to an overly permissive regular expression that matched image URLs containing quotes and angle brackets, including URLs placed inside HTML tags and attribute values. This makes it possible for unauthenticated attackers, such as guest commenters, to inject arbitrary web scripts that execute for moderators viewing the pending comment and for any user who views the comment once it is approved. The image URL conversion feature is enabled by default.
References
- https://wpsec.com/vuln/WPSEC-2026-3063/
- https://plugins.svn.wordpress.org/wpdiscuz/tags/7.7.0/
- https://wordpress.org/plugins/wpdiscuz/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS