What is the CVSS score of CVE-2026-9148?

CVE-2026-9148 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of wpDiscuz are affected by CVE-2026-9148?

The wpDiscuz plugin (versions ≤7.6.56) used on WordPress sites contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into comment…

How to fix or mitigate CVE-2026-9148?

Within 24 hours: identify all WordPress installations using wpDiscuz and confirm current plugin version. Within 7 days: for installations running wpDiscuz ≤7.6.56, disable the plugin entirely or restrict comments to authenticated users only, since no vendor patch is available. Within 30 days: audit the WordPress comments table for injected malicious scripts, monitor the official wpDiscuz advisory for a security release, and plan migration to an alternative comment plugin if patch timeline extends beyond 60 days.

wpDiscuz CVE-2026-9148

EUVD-2026-41514 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-03 Wordfence

GHSA-mh45-hp98-pch7

WordPress XSS Wordpress Plugin Comments Wpdiscuz

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated network injection (AV:N/PR:N), but payload execution needs a victim to view the comment page, so UI:R; script runs in the browser context so S:C with Low C/I and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 08:20 vuln.today

CVE Published

Jul 03, 2026 - 06:50 cve.org

HIGH 7.2

DescriptionCVE.org

The Comments - wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the guest commenter 'Website' field in versions up to, and including, 7.6.56 This is due to insufficient output escaping in the getCommentAuthor() function, which interpolates the stored comment_author_url value directly into single-quoted HTML attributes without applying esc_url() or esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Articles & Coverage 1

News 5 New WordPress Vulnerabilities - 1 Critical, 4 High Severity Jul 04, 2026

AnalysisAI

Stored cross-site scripting in the Comments - wpDiscuz WordPress plugin (versions up to and including 7.6.56) allows unauthenticated guest commenters to persist malicious script by injecting into the 'Website' field, which is later rendered unescaped by getCommentAuthor(). The stored comment_author_url is interpolated directly into single-quoted HTML attributes without esc_url() or esc_attr(), so any visitor viewing an affected comment thread executes the attacker's payload in their browser session. No public exploit identified at time of analysis, but exploitation requires no authentication and the source-level root cause is documented in the WordPress plugin trac.

Technical ContextAI

The affected component is wpDiscuz, a high-traffic AJAX-based commenting plugin for WordPress (CPE cpe:2.3:a:advancedcoding:comments_-_wpdiscuz), which replaces the native WordPress comment form. The flaw is a CWE-79 (Improper Neutralization of Input During Web Page Generation) issue: the guest 'Website' field maps to WordPress's comment_author_url. The referenced source (class.WpdiscuzHelper.php lines 1615/1619 and Website.php line 119) shows getCommentAuthor() emitting the stored URL directly into a single-quoted HTML attribute. Because WordPress's default comment_author_url sanitization (esc_url_raw on storage) does not neutralize characters that break out of a single-quoted attribute context, and the output path omits esc_url()/esc_attr(), an attacker-controlled string reaches the DOM as executable markup. This is a persistent (stored) XSS, meaning the payload is saved server-side and served to every subsequent viewer rather than requiring a crafted link per victim.

RemediationAI

Vendor-released patch: update the Comments - wpDiscuz plugin to version 7.6.57 or later, which corrects the output escaping in getCommentAuthor() as shown in the trac changeset (https://plugins.trac.wordpress.org/changeset/3563675/wpdiscuz/trunk/utils/class.WpdiscuzHelper.php). Review the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/f509f1c6-6094-434d-8e70-ad8419250aa2?source=cve) for indicators. If immediate patching is not possible, compensating controls include disabling the guest 'Website' URL field in wpDiscuz form settings so the comment_author_url cannot be populated (trade-off: legitimate commenters lose the ability to link their site), enabling comment moderation so no guest comment is published until an administrator approves it (trade-off: added moderation workload and delayed comment display), and deploying a WAF rule to block angle brackets/quote-breakout sequences in the wc_comment/website POST parameter (trade-off: possible false positives on legitimate URLs). Audit and sanitize existing stored comment_author_url values, as the patch does not retroactively clean previously injected records.