{"id":"CVE-2026-107765","kind":"vulnerability","aliases":["CVE-2026-107765"],"related":[],"title":"Discussion Board WordPress plugin: profile website field enables stored script injection","description":"The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 via the user profile Website (user_url) field. This is due to insufficient output escaping in the ctdb_filter_comment_author_name() callback hooked to get_comment_author_link, which interpolates the raw user_url value into a single-quoted href attribute without esc_url() or esc_attr(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a Discussion Board topic containing the attacker's reply.","summary":"The Discussion Board WordPress forum plugin up to and including 2.6.0 does not escape a user's profile Website URL when it renders comment author links. A logged-in subscriber can store a script there that runs in the browser of anyone who opens a topic containing their reply.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["discussion-board","package","self-hosted","wordpress"],"not_affected_if":["no-public-registration","plugin-not-installed"],"how_to_check":"- Check the installed version of the Discussion Board plugin in the WordPress admin plugin list; versions `2.6.0` and earlier are affected.\n- Check whether subscriber-level accounts can edit their profile Website field on the site.","fix":"- Discussion Board plugin: a fixed version is not stated in the sources; unknown","status":"open","published_at":"2026-10-31T07:16:34+00:00","first_seen_at":"2026-10-31T07:34:06+00:00","triaged_at":"2026-10-31T07:34:42+00:00","updated_at":"2026-10-31T07:34:42+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T07:34:42Z","model":"claude-haiku-5-5","output":{"fix":"- Discussion Board plugin: a fixed version is not stated in the sources; unknown","reach":"internet","title":"Discussion Board WordPress plugin: profile website field enables stored script injection","impact":"medium","summary":"The Discussion Board WordPress forum plugin up to and including 2.6.0 does not escape a user's profile Website URL when it renders comment author links. A logged-in subscriber can store a script there that runs in the browser of anyone who opens a topic containing their reply.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","discussion-board","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker scripts run in other users' browsers on the site","analyst_note":"Confirm the fixed plugin version from the NVD entry or the WordPress plugin changelog, and whether the flaw needs a specific forum setting.","how_to_check":"- Check the installed version of the Discussion Board plugin in the WordPress admin plugin list; versions `2.6.0` and earlier are affected.\n- Check whether subscriber-level accounts can edit their profile Website field on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-public-registration"],"who_is_affected":"Sites running the Discussion Board plugin version 2.6.0 or earlier where users with subscriber accounts can post in forum topics. The flaw is in rendering the profile website field, so exposure depends on registered users being able to set that field and on other users opening topics with their replies. Sites without the plugin or without open registration are less exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000731,"input_tokens":4267,"output_tokens":608,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107765':14A,17A '-2026':13A,16A '2.6.0':36B,99C 'access':160C,176C 'anyon':68B 'arbitrari':165C 'attack':155C,183C 'attr':148C 'attribut':142C 'authent':154C 'author':50B,120C,127C 'board':2A,20B,28B,78C,179C 'browser':66B 'callback':122C 'comment':49B,119C,126C 'contain':73B,181C 'cross':90C 'cross-sit':89C 'ctdb':117C 'cve':12A,15A 'discuss':1A,19B,27B,77C,178C 'discussion-board':18B 'due':110C 'enabl':8A 'esc':144C,147C 'escap':39B,114C 'execut':172C 'field':7A,107C 'filter':118C 'forum':30B,80C 'get':125C 'hook':123C 'host':24B 'href':141C 'includ':35B,98C 'inject':11A,164C 'insuffici':112C 'interpol':130C 'level':159C 'link':51B,128C 'log':54B 'logged-in':53B 'make':150C 'name':121C 'open':70B 'output':113C 'packag':21B 'page':169C 'plugin':4A,31B,81C,82C 'possibl':152C 'profil':5A,43B,103C 'quot':140C 'raw':132C 'render':48B 'repli':75B,185C 'run':63B 'script':10A,60B,92C,167C 'self':23B 'self-host':22B 'singl':139C 'single-quot':138C 'site':91C 'store':9A,58B,88C 'subscrib':56B,158C 'subscriber-level':157C 'topic':72B,180C 'url':45B,106C,134C,145C 'user':41B,102C,105C,133C,175C 'valu':135C 'version':94C 'via':100C 'vulner':86C 'web':166C 'websit':6A,44B,104C 'whenev':173C 'without':143C 'wordpress':3A,25B,29B,79C,84C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Discussion Board plugin version 2.6.0 or earlier where users with subscriber accounts can post in forum topics. The flaw is in rendering the profile website field, so exposure depends on registered users being able to set that field and on other users opening topics with their replies. Sites without the plugin or without open registration are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T07:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107765","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107765","severity":null,"published_at":"2026-10-31T07:16:34+00:00","modified_at":"2026-10-31T07:16:34+00:00","first_seen_at":"2026-10-31T07:34:06+00:00","fetched_at":"2026-10-31T07:34:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}