---
id: "CVE-2026-119366"
kind: "vulnerability"
aliases: ["CVE-2026-119366"]
title: "wpDiscuz WordPress comments plugin: unauthenticated stored XSS via comment author name through 7.6.73"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "wpdiscuz", "fixed": ["7.6.74"], "affected": "<= 7.6.73", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["other", "self-hosted", "wordpress", "wpdiscuz", "xss"]
not_affected_if: ["plugin-not-installed", "wpdiscuz-7.6.74-or-later"]
published_at: "2026-11-04T08:17:16+00:00"
first_seen_at: "2026-11-04T08:25:59+00:00"
updated_at: "2026-11-04T08:27:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119366", "first_seen_at": "2026-11-04T08:25:59+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T08:27:48+00:00"}]
---

# wpDiscuz WordPress comments plugin: unauthenticated stored XSS via comment author name through 7.6.73

wpDiscuz up to 7.6.73 fills comment templates with sequential str_replace calls, so a placeholder like {TEXT} in a commenter's name is expanded into comment HTML and breaks out of the avatar alt attribute. The reply-to author name is also output unescaped. Per WPSec, unauthenticated visitors can store script that runs for anyone viewing the page, including a moderator viewing a pending comment.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wpdiscuz affected <= 7.6.73 fixed 7.6.74

## How to check

- In WordPress admin > Plugins, check the wpDiscuz version; 7.6.73 or earlier is affected.
- Or run: wp plugin get wpdiscuz --field=version
- Check for existing comments whose author name contains template placeholders like {TEXT} or HTML/script.

## Fix

Update wpDiscuz to 7.6.74 or later (per WPSec; vendor changelog not confirmed)

## Timeline

- 2026-11-04T08:25:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119366
- 2026-11-04T08:27:48+00:00 analyst — Fix 7.6.74 and unauthenticated vector come from WPSec (third party); wordpress.org changelog/svn not readable, so nothing marked verified. NVD page empty.

## Documents

- [describes] WPSec: wpDiscuz <= 7.6.73 Unauthenticated Stored XSS via Comment Author Name https://wpsec.com/vuln/WPSEC-2026-2055/

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.73.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_