CVE-2026-22183

MEDIUM

wpDiscuz < 7.6.47 - Authenticated Stored Cross-Site Scripting in Inline Comment Preview

Title source: llm
STIX 2.1

Description

wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inject malicious scripts by submitting comments with unescaped content. Attackers with unfiltered_html capabilities can inject JavaScript directly through comment content rendered in the AJAX response from the getLastInlineComments() function in class.WpdiscuzHelperAjax.php without proper HTML escaping.

References (3)

Core 3

Scores

CVSS v3 6.1
EPSS 0.0017
EPSS Percentile 6.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (3)
gVectors/wpDiscuz < 7.6.47
gvectors/wpdiscuz < 7.6.47
gVectors/wpDiscuz 7.6.47
Published Mar 13, 2026
Tracked Since Mar 14, 2026