Discussion Board CVE-2026-107765

Requires an authenticated account with subscriber-level privileges or higher (PR:L); the attacker places a script payload in the WordPress user profile Website (user_url) field, which the ctdb_filter_comment_author_name() callback hooked to get_comment_author_link interpolates into a single-quoted href attribute without esc_url() or esc_attr(). The payload fires when any user views a Discussion Board topic that contains a reply authored by the attacker. Limiting factors: exploitation is gated by needing a valid low-privilege account, so sites that allow open/self user registration are materially more exposed than closed sites; the malicious author link must actually be rendered in a topic the victim visits. Affected versions are up to and including 2.6.0.

This is a stored XSS flaw (CWE-79) carrying a moderate CVSS 3.1 base score of 6.4. The supplied vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N indicates network reach, low complexity, and - via PR:L - an authenticated attacker holding at least subscriber-level access; the S:C (scope change) reflects that the injected script executes in the browsers of other users viewing the topic rather than only in the vulnerable component, which is the normal and correct modeling for stored XSS. No EPSS probability is provided in the input and the CVE is not listed in CISA KEV, so there is no signal of active or widespread exploitation; the Wordfence priority label is 'this_month', consistent with a real-but-not-emergency issue. No SSVC decision fields (automatable, technical impact) were supplied. The practical risk is bounded by the authentication requirement: an attacker must obtain a subscriber account, which is trivial on sites that permit open self-registration but a meaningful barrier on closed sites. Net assessment: a genuine, verifiable stored-XSS requiring remediation on normal patch cadence, not a high-CVSS/low-real-risk false alarm, but also not an emergency - its reach depends heavily on whether the affected site allows user registration.

An attacker registers (or uses) a subscriber-level account on a WordPress site running the Discussion Board plugin and sets their profile Website (user_url) field to a value containing a crafted script payload. When they post a reply in a Discussion Board topic, the unescaped user_url is interpolated into the comment author link, so the script executes in the browser of every user who later views that topic. No public exploit is identified in the supplied data, but the low attack complexity and authenticated-but-low-privilege requirement make exploitation straightforward where registration is open.