CVE-2026-22192

CRITICAL

wpDiscuz <7.6.47 - Stored XSS

Title source: llm

Description

Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to access privileged management functions by manipulating browser localStorage values. Attackers can modify client-side authentication state to bypass server-side access controls and gain unauthorized access to protected management functionality without valid credentials.

References (7)

[Product] https://wordpress.org/plugins/wpdiscuz/

[Product] https://wordpress.org/plugins/wpdiscuz/#developers

[Third Party Advisory] https://www.vulncheck.com/advisories/wpdiscuz-before-stored-cross-site-scripting-via-malicious-options-import

[Technical Description] https://github.com/kmkz/Exploits/blob/master/2026/CVE-2026-22192-22199_Voltronic-Power_Preauth_root_RCE.txt

View Writeup ZIP pw:eip

[Technical Description] https://www.boffsec-services.com/posts/sicuroweb-cve-2026-22191/

[Product] https://voltronicpower.com/

[Third Party Advisory] https://www.vulncheck.com/advisories/voltronic-power-snmp-web-pro-authentication-bypass-via-localstorage

Scores

CVSS v3 9.9

EPSS 0.0007

EPSS Percentile 20.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

Details

CWE

CWE-306

Status published

Products (4)

gVectors/wpDiscuz < 7.6.47

gvectors/wpdiscuz < 7.6.47

gVectors/wpDiscuz 7.6.47

Voltronic Power/SNMP Web Pro 1.1

Published Mar 13, 2026

Tracked Since Mar 14, 2026