Live › vulnerability › CVE-2026-107765
The Discussion Board WordPress forum plugin up to and including 2.6.0 does not escape a user's profile Website URL when it renders comment author links. A logged-in subscriber can store a script there that runs in the browser of anyone who opens a topic containing their reply.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Sites running the Discussion Board plugin version 2.6.0 or earlier where users with subscriber accounts can post in forum topics. The flaw is in rendering the profile website field, so exposure depends on registered users being able to set that field and on other users opening topics with their replies. Sites without the plugin or without open registration are less exposed.
No product ranges from the sources yet.
2.6.0 and earlier are affected.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 via the user profile Website (user_url) field. This is due to insufficient output escaping in the ctdb_filter_comment_author_name() callback hooked to get_comment_author_link, which interpolates the raw user_url value into a single-quoted href attribute without esc_url() or esc_attr(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a Discussion Board topic containing the attacker's reply.
This page as .md · .json · in your agent: get_signal("CVE-2026-107765")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.