# Comments – wpDiscuz <= 7.6.75 - Unauthenticated Stored Cross-Site Scripting via Comment Image URL Conversion

- **ID:** WPSEC-2026-3063
- **Plugin:** Comments – wpDiscuz (`wpdiscuz`), https://wordpress.org/plugins/wpdiscuz/
- **Affected versions:** all versions before 7.7.0
- **Fixed in:** 7.7.0 (Update to 7.7.0 or later.)
- **Severity:** High 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpdiscuz
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3063/

## Description

The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image URL to <img> conversion applied to comment content in all versions up to, and including, 7.6.75 due to an overly permissive regular expression that matched image URLs containing quotes and angle brackets, including URLs placed inside HTML tags and attribute values. This makes it possible for unauthenticated attackers, such as guest commenters, to inject arbitrary web scripts that execute for moderators viewing the pending comment and for any user who views the comment once it is approved. The image URL conversion feature is enabled by default.

## References

- https://wpsec.com/vuln/WPSEC-2026-3063/
- https://plugins.svn.wordpress.org/wpdiscuz/tags/7.7.0/
- https://wordpress.org/plugins/wpdiscuz/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3063/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.