Cross-Site Scripting Flaw in wpDiscuz by WordPress

CVE-2026-22210

What is CVE-2026-22210?

The wpDiscuz plugin for WordPress, versions prior to 7.6.47, is susceptible to a cross-site scripting vulnerability. This flaw arises when unescaped attachment URLs are processed in HTML outputs. Attackers can leverage this vulnerability by crafting malicious attachment records or exploiting filter hooks, which allows them to inject arbitrary JavaScript code into the attributes of image and anchor tags. When WordPress users view comments with compromised input, malicious scripts may run in their browsers, potentially leading to unauthorized actions or data compromise.

References