CVE-2026-22183 MEDIUM

CVE-2026-22183: wpDiscuz before 7.6.47 - Stored Cross-Site Scripting in Inline Comment Preview

Vendor Gvectors
Product wpDiscuz
Weakness CWE-79 · XSS
Published March 13, 2026
Last update March 13, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

What the vulnerability does

01Description

wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inject malicious scripts by submitting comments with unescaped content. Attackers with unfiltered_html capabilities can inject JavaScript directly through comment content rendered in the AJAX response from the getLastInlineComments() function in class.WpdiscuzHelperAjax.php without proper HTML escaping.

Key dates

02Disclosure timeline

March 13, 2026 CVE published
March 13, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-25117 WordPress Smart Countdown FX plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability CVE-2022-3127 Cross-site Scripting (XSS) - Stored in jgraph/drawio CVE-2024-4895 wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.12 - Unauthenticated Stored Cross-Site Scripting via CSV Import CVE-2025-5887 jsnjfz WebStack-Guns File Upload UserMgrController.java cross site scripting CVE-2025-58988 WordPress My Tickets Plugin <= 2.0.22 - Cross Site Scripting (XSS) Vulnerability