CVE-2026-22183: wpDiscuz before 7.6.47 - Stored Cross-Site Scripting in Inline Comment Preview
wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inject malicious scripts by submitting comments with unescaped content. Attackers with unfilteredhtml capabilities can inject JavaScript directly through comment content rendered in the AJAX response from the getLastInlineComments() function in class.WpdiscuzHelperAjax.php without proper HTML escaping.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22183?
CVE-2026-22183 is a high-severity vulnerability due to the potential for stored cross-site scripting attacks.
How do I fix CVE-2026-22183?
To fix CVE-2026-22183, update wpDiscuz to version 7.6.47 or later.
Who is affected by CVE-2026-22183?
CVE-2026-22183 affects users of wpDiscuz versions prior to 7.6.47.
What is the nature of the vulnerability in CVE-2026-22183?
CVE-2026-22183 involves a stored cross-site scripting vulnerability in the inline comment preview feature.
Can authenticated users exploit CVE-2026-22183?
Yes, authenticated users can exploit CVE-2026-22183 by submitting comments with unescaped input.