CVE-2026-22210: wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs
wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22210?
CVE-2026-22210 is classified as a high-severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2026-22210?
To fix CVE-2026-22210, upgrade wpDiscuz to version 7.6.47 or later.
What is the impact of CVE-2026-22210?
The impact of CVE-2026-22210 allows attackers to inject malicious scripts through unescaped attachment URLs, potentially compromising user security.
Who is affected by CVE-2026-22210?
Users of wpDiscuz versions prior to 7.6.47 are affected by CVE-2026-22210.
How can attackers exploit CVE-2026-22210?
Attackers can exploit CVE-2026-22210 by injecting malicious code into HTML outputs via unescaped attachment URLs.