CVE-2026-22210CWE-79

wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs

Low · published March 13, 2026

CVSS v4.0
2.1
EPSS
0%
Percentile
5.7
In the wild
Unconfirmed
What it is

wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00167 · 5.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-03-13T01:18Z
EPSS history
Timeline
  • 13 MAR 01:18Z
    wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs
    cvelistv5