CVE-2026-22210
wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs
CVSS Score
4.4
EPSS Score
0.0%
EPSS Percentile
0th
wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.
| CWE | CWE-79 |
| Vendor | gvectors |
| Product | wpdiscuz |
| Published | Mar 13, 2026 |
| Last Updated | Mar 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for gvectors wpdiscuz
Be the first to know when new medium vulnerabilities affecting gvectors wpdiscuz are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
gVectors / wpDiscuz
0 < 7.6.47
References
Credits
Scott Moore - VulnCheck