CVE-2026-22209 — Comments – wpDiscuz [wpdiscuz] < 7.6.47

CVE	Vulnerability	Type	Severity	Affected	Fixed in	Published	Status
CVE-2026-22209	Comments – wpDiscuz [wpdiscuz] < 7.6.47	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	Medium 5.5	< 7.6.47	7.6.47	2026-03-13	—

CVE-2026-22209

wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking out of style tags. Attackers with admin access can inject payloads like </style><script>alert(1)</script> in the custom CSS setting to execute arbitrary JavaScript in user browsers.

Source: CVE.org

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)