Vulnerability · Published Mar 13, 2026 · Assigned by VulnCheck

CVE-2026-22210wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs

Medium 4.4

In plain English

A medium-severity cross-site scripting in wpDiscuz from gVectors. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.2%top 93.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.

Affected products (as reported)

Vendor	Product	Versions
gVectors	wpDiscuz	0 – before 7.6.47

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

References

wpDiscuz Changelog patch
wpDiscuz product
VulnCheck Advisory: wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs third-party-advisory