CVE-2026-107765: Discussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Field

Q: Who can exploit this issue?

An attacker needs an authenticated WordPress account with Subscriber-level permissions or higher. They must be able to set their profile Website (user_url) field and post a reply in a Discussion Board topic.

Q: When does the injected script run?

The script executes when another user accesses a Discussion Board topic containing the attacker's reply. The issue is stored XSS, so the malicious value can persist until it is removed or corrected.

Q: Are unauthenticated visitors able to inject the payload?

No. The described attack requires authenticated access at Subscriber level or above; the provided information does not indicate unauthenticated injection.

Q: What can be done before updating?

Restrict or remove Subscriber-and-higher accounts that are not trusted, and review user profile Website fields and Discussion Board replies for malicious content. Remove suspicious replies and reset or sanitize malicious user_url values.

Published Oct 31, 2026

Updated

The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 via the user profile Website (userurl) field. This is due to insufficient output escaping in the ctdbfiltercommentauthorname() callback hooked to getcommentauthorlink, which interpolates the raw userurl value into a single-quoted href attribute without escurl() or escattr(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a Discussion Board topic containing the attacker's reply.

Event History

Oct 31, 2026

CVE Published

via MITRE·06:44 AM

Data Sourced

via MITRE·06:44 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker needs an authenticated WordPress account with Subscriber-level permissions or higher. They must be able to set their profile Website (user_url) field and post a reply in a Discussion Board topic.

When does the injected script run?

The script executes when another user accesses a Discussion Board topic containing the attacker's reply. The issue is stored XSS, so the malicious value can persist until it is removed or corrected.

Are unauthenticated visitors able to inject the payload?

No. The described attack requires authenticated access at Subscriber level or above; the provided information does not indicate unauthenticated injection.

What can be done before updating?

Restrict or remove Subscriber-and-higher accounts that are not trusted, and review user profile Website fields and Discussion Board replies for malicious content. Remove suspicious replies and reset or sanitize malicious user_url values.

CVE-2026-107765: Discussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Field

Event History

Frequently Asked Questions

Who can exploit this issue?

When does the injected script run?

Are unauthenticated visitors able to inject the payload?

What can be done before updating?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

When does the injected script run?

Are unauthenticated visitors able to inject the payload?

What can be done before updating?