{"id":"CVE-2026-119366","kind":"vulnerability","aliases":["CVE-2026-119366"],"related":[],"title":"wpDiscuz WordPress comments plugin: unauthenticated stored XSS via comment author name through 7.6.73","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.73.","summary":"wpDiscuz up to 7.6.73 fills comment templates with sequential str_replace calls, so a placeholder like {TEXT} in a commenter's name is expanded into comment HTML and breaks out of the avatar alt attribute. The reply-to author name is also output unescaped. Per WPSec, unauthenticated visitors can store script that runs for anyone viewing the page, including a moderator viewing a pending comment.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wpdiscuz","fixed":["7.6.74"],"affected":"<= 7.6.73","ecosystem":"wordpress"}],"ecosystems":[],"tags":["other","self-hosted","wordpress","wpdiscuz","xss"],"not_affected_if":["plugin-not-installed","wpdiscuz-7.6.74-or-later"],"how_to_check":"- In WordPress admin > Plugins, check the wpDiscuz version; 7.6.73 or earlier is affected.\n- Or run: wp plugin get wpdiscuz --field=version\n- Check for existing comments whose author name contains template placeholders like {TEXT} or HTML/script.","fix":"Update wpDiscuz to 7.6.74 or later (per WPSec; vendor changelog not confirmed)","status":"open","published_at":"2026-11-04T08:17:16+00:00","first_seen_at":"2026-11-04T08:25:59+00:00","triaged_at":"2026-11-04T08:26:33+00:00","updated_at":"2026-11-04T08:27:48+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-04T08:26:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"wpDiscuz WordPress comments plugin: stored cross-site scripting through 7.6.73","impact":"medium","summary":"wpDiscuz, a WordPress comments plugin by AdvancedCoding, does not neutralize input when generating web pages, enabling stored cross-site scripting. An attacker who can post a comment can plant script that runs in other visitors' browsers, including administrators'.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","wpdiscuz","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in visitors' and admins' browsers, enabling session theft","analyst_note":"Confirm the fixed version and which comment roles can inject the payload from the NVD entry or the vendor advisory.","how_to_check":"- Check the installed wpDiscuz version in the WordPress admin plugins list or the plugin's main file header.\n- Compare the installed version against the affected range: `7.6.73` and earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"WordPress sites running wpDiscuz at version 7.6.73 or earlier are exposed through comment input rendered to other visitors. Sites without wpDiscuz installed, or running a newer release, are not affected. The sources do not state which comment roles can post the payload.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000688,"input_tokens":4126,"output_tokens":550,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version and which comment roles can inject the payload from the NVD entry or the vendor advisory.","search":"'-119366':16A,19A '-2026':15A,18A '7.6.73':13A,31B,120C 'advancedcod':108C 'affect':115C 'allow':111C 'also':70B 'alt':61B 'anyon':83B 'attribut':62B 'author':10A,67B 'avatar':60B 'break':56B 'call':39B 'comment':3A,9A,33B,47B,53B,93B 'cross':103C 'cross-sit':102C 'cve':14A,17A 'expand':51B 'fill':32B 'generat':101C 'host':24B 'html':54B 'improp':94C 'includ':87B 'input':97C 'issu':114C 'like':43B 'moder':89B 'n/a':118C 'name':11A,49B,68B 'neutral':95C 'output':71B 'page':86B,100C 'pend':92B 'per':73B 'placehold':42B 'plugin':4A 'replac':38B 'repli':65B 'reply-to':64B 'run':81B 'script':79B,105C 'self':23B 'self-host':22B 'sequenti':36B 'site':104C 'store':6A,78B,112C 'str':37B 'templat':34B 'text':44B 'unauthent':5A,75B 'unescap':72B 'via':8A 'view':84B,90B 'visitor':76B 'vulner':106C 'web':99C 'wordpress':2A,25B 'wpdiscuz':1A,20A,26B,28B,109C,110C,116C 'wpsec':74B 'xss':7A,27B 'xss.this':113C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running wpDiscuz 7.6.73 or earlier. According to WPSec, no account is needed: any visitor who can submit a comment can set the author name. Sites without wpDiscuz, or on 7.6.74 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wpdiscuz"],"ptokens":["wpdiscuz"],"labels":["high","other","selfhosted","wordpress","wpdiscuz","xss"],"campaign_type":null,"first_public_at":"2026-11-04T08:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119366","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119366","severity":null,"published_at":"2026-11-04T08:17:16+00:00","modified_at":"2026-11-04T08:17:16+00:00","first_seen_at":"2026-11-04T08:25:59+00:00","fetched_at":"2026-11-04T08:25:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119366:1648","url":null,"severity":null,"published_at":"2026-11-04T08:27:48+00:00","modified_at":"2026-11-04T08:27:48+00:00","first_seen_at":"2026-11-04T08:27:48+00:00","fetched_at":"2026-11-04T08:27:48+00:00","note":"Fix 7.6.74 and unauthenticated vector come from WPSec (third party); wordpress.org changelog/svn not readable, so nothing marked verified. NVD page empty."}],"documents":[{"id":65459,"url":"https://wpsec.com/vuln/WPSEC-2026-2055/","title":"WPSec: wpDiscuz <= 7.6.73 Unauthenticated Stored XSS via Comment Author Name","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}