WPDISCUZ · CVE-2026-119366 · Other
FIX → 7.6.74
wpDiscuz up to 7.6.73 fills comment templates with sequential str_replace calls, so a placeholder like {TEXT} in a commenter's name is expanded into comment HTML and breaks out of the avatar alt attribute. The reply-to author name is also output unescaped. Per WPSec, unauthenticated visitors can store script that runs for anyone viewing the page, including a moderator viewing a pending comment.
first public Nov 4, 2026 · 2 sources
Running Wpdiscuz? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
WordPress sites running wpDiscuz 7.6.73 or earlier. According to WPSec, no account is needed: any visitor who can submit a comment can set the author name. Sites without wpDiscuz, or on 7.6.74 or later, can skip it.
Not affected if plugin-not-installed, wpdiscuz-7.6.74-or-later
Who cares self-hosted, wordpress, wpdiscuz, xss
Upgrade to 7.6.74
Update wpDiscuz to 7.6.74 or later (per WPSec; vendor changelog not confirmed)
Posts are quoted with a link to the original. They are data to us, never instructions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.73.
This page as .md · .json · in your agent: get_signal("CVE-2026-119366") · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.