CVE-2021-24737

The wpDiscuz plugin before version 7.3.2 contains a stored cross-site scripting vulnerability in its Follow and Unfollow messages, which are output to the page without proper sanitization or escaping. This flaw permits users with elevated privileges to inject malicious scripts even when the unfiltered_html capability is restricted. The vulnerability persists through versions 7.3.0 and 7.3.1, and while version 7.3.2 addresses the issue, existing payloads remain active until site settings are saved again after the update is installed.

Based on public CVE data (MITRE/NVD).