wpDiscuz EUVD-2026-116777

Exploitation requires an attacker to deliver a crafted payload through a wpDiscuz input that is persistently stored, and then requires a victim to view the page where that payload is rendered (UI:R) - the stored script does not execute without a victim loading the affected content. Per the CVSS vector (PR:N) no attacker authentication is required. The input does not describe which exact wpDiscuz field, form, or configuration is the injection vector, so the precise sink is not specified in the available sources. The chief limiting factor is the required victim interaction and the fact that impact is confined to the browser context of whoever views the malicious content (Low confidentiality/integrity/availability) rather than direct server compromise; the plugin must also be installed and actively rendering the affected input.

This is a moderate-severity stored XSS (CVSS 7.1) that warrants prompt but not emergency remediation, consistent with the 'this_week' priority label from vuln.today. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates a network-reachable flaw of low attack complexity requiring no privileges (PR:N, i.e. unauthenticated) but requiring victim user interaction (UI:R) - a victim must view the page where the malicious payload is stored. The scope change (S:C) and Low/Low/Low impacts reflect that injected script executes in the victim's browser context rather than directly compromising the server. No EPSS score, no CISA KEV listing, and no verified exploit code are present in the input; the sole reference is a Patchstack database entry, not a working PoC. Exploitation status is therefore: no public exploit identified at time of analysis. The absence of KEV/EPSS data means real-world exploitation probability cannot be quantified from the provided signals - it is neither confirmed nor ruled out. On balance this is a genuine but not critical priority: a stored XSS in a widely-installed WordPress commenting plugin is realistically abusable for session/credential theft and admin-targeting, but the UI:R requirement and the absence of exploitation evidence keep it below the tier reserved for actively exploited or wormable flaws.

An attacker submits a comment or input through wpDiscuz containing a malicious script payload that is stored and later rendered unsanitized when another user - potentially a site administrator moderating comments - views the affected page, executing the script in that victim's browser session. Because the CVSS vector is AV:N/PR:N/UI:R, this requires no attacker authentication but does depend on a victim viewing the stored content. No verified public exploit code is identified in the available data.