blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-22210

LOW 2.1 CVSS 4.0
Published
March 13, 2026
Last modified
June 17, 2026
NVD status
Analyzed
Reported by
disclosure@vulncheck.com
Weakness
CWE-79
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Description

wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • gVectors wpDiscuz — Before 7.6.47
  • gvectors wpdiscuz — Before 7.6.47

References

  • wordpress.org https://wordpress.org/plugins/wpdiscuz/ Product
  • wordpress.org https://wordpress.org/plugins/wpdiscuz/#developers Product, Release Notes
  • www.vulncheck.com https://www.vulncheck.com/advisories/wpdiscuz-before-cross-site-scripting-via-unescaped-attachment-urls Third Party Advisory
  • nvd.nist.gov Official NVD record