CVE-2026-119366: WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability

Q: What conditions are indicated for exploitation?

The CVSS vector indicates that the issue can be exploited over the network with low attack complexity and does not require privileges. It also indicates that user interaction is required.

Q: What impact is indicated by the severity vector?

The vector indicates low impacts to confidentiality, integrity, and availability, with a changed scope. The reported severity is high with a 7.1 score.

Published Nov 4, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.73.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress wpDiscuz to a version that resolves this vulnerability.
Fixed in 7.6.74

Event History

Nov 4, 2026

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are indicated for exploitation?

The CVSS vector indicates that the issue can be exploited over the network with low attack complexity and does not require privileges. It also indicates that user interaction is required.

What impact is indicated by the severity vector?

The vector indicates low impacts to confidentiality, integrity, and availability, with a changed scope. The reported severity is high with a 7.1 score.

CVE-2026-119366: WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

What conditions are indicated for exploitation?

What impact is indicated by the severity vector?

Company

Resources

Contact

Frequently Asked Questions

What conditions are indicated for exploitation?

What impact is indicated by the severity vector?