What is the CVSS score of CVE-2026-22210?

CVE-2026-22210 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Wpdiscuz are affected by CVE-2026-22210?

Organizations using wpDiscuz before 7.6.47 should be aware of moderate risk from CVE-2026-22210, a cross-site scripting vulnerability rated CVSS 4.4.. A patch is available.

How to fix or mitigate CVE-2026-22210?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

Wpdiscuz CVE-2026-22210

EUVD-2026-11751 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-13 VulnCheck

XSS WordPress Wpdiscuz

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 16, 2026 - 14:54 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 07:58 euvd

EUVD-2026-11751

Analysis Generated

Mar 13, 2026 - 07:58 vuln.today

CVE Published

Mar 13, 2026 - 01:18 nvd

MEDIUM 4.4

DescriptionCVE.org

wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.

AnalysisAI

wpDiscuz before version 7.6.47 contains a stored cross-site scripting (XSS) vulnerability in the WpdiscuzHelperUpload class that fails to properly escape attachment URLs when rendering HTML output. Attackers with limited privileges (contributor level or higher) can inject malicious JavaScript through crafted attachment records or WordPress filter hooks, which executes in the browsers of any WordPress user viewing the affected comments. This vulnerability requires user interaction (victim must view the comment) and has moderate real-world impact due to the authentication requirement and user interaction factor, though successful exploitation could lead to session hijacking or credential theft from comment viewers.

Technical ContextAI

The vulnerability resides in the WpdiscuzHelperUpload class within the wpDiscuz WordPress plugin, a popular comment system enhancement. The root cause is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting), which occurs when user-controlled data is rendered in HTML attributes without proper escaping or sanitization. The affected code fails to use WordPress escaping functions (such as esc_url, esc_attr, or wp_kses_post) when outputting attachment URLs into img and anchor tag attributes within comment HTML. The attack vector is network-based, leveraging WordPress's comment and attachment infrastructure, with the exploit requiring low-complexity manipulation of attachment metadata or filter hook parameters.

RemediationAI

Upgrade wpDiscuz to version 7.6.47 or later immediately using the WordPress plugin update interface or by manually downloading the patched version from the official WordPress plugin repository. The update process is straightforward: navigate to Plugins → Installed Plugins, locate wpDiscuz, and click the Update button if available. As a temporary mitigation until patching is feasible, restrict comment permissions to trusted users only, enable strict comment moderation to review all comments before publication, and disable attachment uploads in comments if the feature is not essential. Additionally, implement Content Security Policy (CSP) headers on your WordPress installation to mitigate XSS impact by restricting script execution, and monitor user accounts with contributor or higher privileges for unauthorized activity.