Stored XSS Vulnerability in Discussion Board Plugin for WordPress

CVE-2026-107765

What is CVE-2026-107765?

The Discussion Board – WordPress Forum Plugin contains a stored cross-site scripting vulnerability in the user profile Website field. This issue arises due to inadequate output escaping within the ctdb_filter_comment_author_name() function. When this function processes the raw user_url value without applying necessary security measures such as esc_url() or esc_attr(), it allows authenticated attackers with subscriber-level access and above to embed malicious web scripts. Such scripts will execute in users' browsers when they access discussion topics containing the attacker's reply, posing a significant security risk.

References