{
 "id": "WPSEC-2026-3063",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3063/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3063/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3063/index.md",
 "title": "Comments – wpDiscuz <= 7.6.75 - Unauthenticated Stored Cross-Site Scripting via Comment Image URL Conversion",
 "description": "The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image URL to <img> conversion applied to comment content in all versions up to, and including, 7.6.75 due to an overly permissive regular expression that matched image URLs containing quotes and angle brackets, including URLs placed inside HTML tags and attribute values. This makes it possible for unauthenticated attackers, such as guest commenters, to inject arbitrary web scripts that execute for moderators viewing the pending comment and for any user who views the comment once it is approved. The image URL conversion feature is enabled by default.",
 "plugin": {
  "slug": "wpdiscuz",
  "name": "Comments – wpDiscuz",
  "full_name": "Comments – wpDiscuz",
  "wordpress_org": "https://wordpress.org/plugins/wpdiscuz/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wpdiscuz/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wpdiscuz"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "7.7.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 7.7.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "7.7.0",
 "remediation": "Update to 7.7.0 or later.",
 "fix_released": "2026-11-12T13:19:31+00:00",
 "published": "2026-11-13T13:41:21+00:00",
 "updated": "2026-11-12T17:16:13.225832+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3063/",
  "https://plugins.svn.wordpress.org/wpdiscuz/tags/7.7.0/",
  "https://wordpress.org/plugins/wpdiscuz/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wpdiscuz",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-13"
 }
}