{"id":"CVE-2026-115957","kind":"vulnerability","aliases":["CVE-2026-115957"],"related":[],"title":"WP Discussion Board WordPress plugin: stored XSS through 2.6.0","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Stored XSS.This issue affects WP Discussion Board: from n/a through 2.6.0.","summary":"The WP Discussion Board plugin for WordPress stores user input that is later rendered without proper neutralization, a stored cross-site scripting flaw. An attacker who can submit content can run script in the browser of other users who view the page, including administrators.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","wordpress","wp-discussion-board"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the wp-discussion-board plugin in the WordPress admin under Plugins, or in `wp-content/plugins/wp-discussion-board/`\n- Compare against the fixed release named in the vendor advisory: unknown","fix":"- Update WP Discussion Board to a version later than `2.6.0`: the fixed version is unknown from the sources\n- If no fixed version exists, deactivate the plugin until one is released","status":"open","published_at":"2026-10-28T13:17:05+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","triaged_at":"2026-10-28T13:34:22+00:00","updated_at":"2026-10-28T13:34:22+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-28T13:34:22Z","model":"claude-haiku-5-5","output":{"fix":"- Update WP Discussion Board to a version later than `2.6.0`: the fixed version is unknown from the sources\n- If no fixed version exists, deactivate the plugin until one is released","reach":"internet","title":"WP Discussion Board WordPress plugin: stored XSS through 2.6.0","impact":"medium","summary":"The WP Discussion Board plugin for WordPress stores user input that is later rendered without proper neutralization, a stored cross-site scripting flaw. An attacker who can submit content can run script in the browser of other users who view the page, including administrators.","category":"other","nicknames":[],"who_cares":["wordpress","wp-discussion-board"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker script runs in other users' browsers, possibly admins","analyst_note":"Confirm the fixed version and whether submitting content requires a login, at https://nvd.nist.gov/vuln/detail/CVE-2026-115957 and the plugin's WordPress.org page.","how_to_check":"- Check the installed version of the wp-discussion-board plugin in the WordPress admin under Plugins, or in `wp-content/plugins/wp-discussion-board/`\n- Compare against the fixed release named in the vendor advisory: unknown","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP Discussion Board WordPress plugin at version 2.6.0 or earlier are affected. Sites without this plugin installed can skip it. Whether anonymous visitors can submit content that triggers the flaw is unknown from the sources.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000633,"input_tokens":3320,"output_tokens":601,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115957':12A,15A '-2026':11A,14A '2.6.0':9A,102C 'administr':66B 'affect':95C 'allow':91C 'attack':47B 'board':3A,21B,25B,83C,86C,90C,98C 'browser':57B 'content':51B 'cross':42B,76C 'cross-sit':41B,75C 'cve':10A,13A 'discuss':2A,20B,24B,82C,85C,89C,97C 'flaw':45B 'generat':74C 'improp':67C 'includ':65B 'input':31B,70C 'issu':94C 'later':34B 'n/a':100C 'neutral':38B,68C 'page':64B,73C 'plugin':5A,26B 'proper':37B 'render':35B 'run':53B 'script':44B,54B,78C 'site':43B,77C 'store':6A,29B,40B,92C 'submit':50B 'user':30B,60B 'view':62B 'vulner':79C 'web':72C 'without':36B 'wordpress':4A,17B,28B 'wp':1A,19B,23B,81C,84C,88C,96C 'wp-discussion-board':18B,87C 'xss':7A 'xss.this':93C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP Discussion Board WordPress plugin at version 2.6.0 or earlier are affected. Sites without this plugin installed can skip it. Whether anonymous visitors can submit content that triggers the flaw is unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T13:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115957","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115957","severity":null,"published_at":"2026-10-28T13:17:05+00:00","modified_at":"2026-10-28T13:17:05+00:00","first_seen_at":"2026-10-28T13:33:01+00:00","fetched_at":"2026-10-28T13:33:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}