CVE-2026-22210 — Comments – wpDiscuz [wpdiscuz] < 7.6.47

CVE	Vulnerability	Type	Severity	Affected	Fixed in	Published	Status
CVE-2026-22210	Comments – wpDiscuz [wpdiscuz] < 7.6.47	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Medium 6.1	< 7.6.47	7.6.47	2026-03-13	—

CVE-2026-22210

wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.

Source: CVE.org

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)