CVE-2026-27154 LOW

CVE-2026-27154: Discourse has XSS when editing a malicious post

Vendor Discourse
Product discourse
Weakness CWE-79 · XSS
Published February 26, 2026
Last update March 2, 2026
View on NVD All CVEs

CVSS base score

1.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U

What the vulnerability does

01Description

Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, a user full name can be evaluated as raw HTML when the following settings are set: `display_name_on_posts` => true; and `prioritize_username_in_ux` => false. Editing a post of a malicious user would trigger an XSS. Versions 2025.12.2, 2026.1.1, and 2026.2.0 patch the issue. No known workarounds are available.

Key dates

02Disclosure timeline

February 26, 2026 CVE published
March 2, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-47644 WordPress Copyscape Premium plugin <= 1.3.9 - CSRF to Stored Cross-Site Scripting vulnerability CVE-2024-36146 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) CVE-2025-31590 WordPress WP Date and Time Shortcode plugin <= 2.6.7 - Cross Site Scripting (XSS) vulnerability CVE-2025-67533 WordPress Themify Portfolio Post plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability CVE-2024-3004 code-projects Online Book System Product.php cross site scripting