CVE-2026-72727
Discourse: Stored XSS in the moderation review queue
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
| CWE | CWE-79 |
| Vendor | discourse |
| Product | discourse |
| Published | Aug 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for discourse discourse
Be the first to know when new unknown vulnerabilities affecting discourse discourse are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
discourse / discourse
< 2026.1.6 >= 2026.5.0-latest, < 2026.5.2 >= 2026.6.0-latest, < 2026.6.1