WordPress CVEs

Description

The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 7.6.21. This is due to a lack of filtering of HTML tags in comments. This makes it possible for unauthenticated attackers to add HTML such as hyperlinks to comments when rich editing is disabled.

Affected WordPress components

• Comments – wpDiscuz Plugin · wpdiscuz
  Confirmed match Active
  Up to and including 7.6.21; Before 7.6.22
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• advancedcoding Comments – wpDiscuz — Up to and including 7.6.21
• gvectorsteam comments-wpdiscuz — Up to and including 7.6.21
• gvectors wpdiscuz — Before 7.6.22

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wpdiscuz/trunk/class.WpdiscuzCore.php#L335 Product
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3124810/ Patch
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/fa3501a4-7975-4f90-8037-f8a06c293c07?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record