CVSS base score
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
What the vulnerability does
wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.
Explanation of Vulnerability in Simple Terms
wpDiscuz versions before 7.6.47 contain a cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious scripts. The vulnerability requires user interaction and has limited scope, affecting only the integrity of the vulnerable component. Site administrators should update to version 7.6.47 or later to remediate this issue.
What an attacker can do
Inject malicious scripts that execute in other users' browsers when they interact with the plugin.
Potential impact on your site
Users may have their sessions compromised or be redirected to malicious sites if they interact with injected content.
Conditions required to exploit
Attacker must have low-level user account access and the victim must click a malicious link or visit a crafted page.
Key dates
External resources
Related vulnerabilities
