CVE-2026-22209 wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Custom CSS in Style Tag
Administrators can inject malicious JavaScript via unescaped custom CSS in wpDiscuz, leading to arbitrary script execution in user browsers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-22209?
CVE-2026-22209 is a medium-severity cross-site scripting vulnerability in gVectors wpDiscuz, published on 13 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking out of style tags. Attackers with admin access can inject payloads like </style><script>alert(1)</script> in the custom CSS setting to execute arbitrary JavaScript in user browsers.
Weakness: CWE-79
Which versions are affected by CVE-2026-22209?
It affects 1 product.
Products include Gvectors Wpdiscuz.
How do I fix CVE-2026-22209?
No fix has been published for CVE-2026-22209 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-22209 being exploited?
There is no known exploitation of CVE-2026-22209 in the wild and no public exploit code.
Other vulnerabilities in gVectors wpDiscuz
- CVE-2020-24186 File upload in n/a
- CVE-2024-9488 Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2020-13640 SQL injection in n/a
- CVE-2026-22193 wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions()
- CVE-2026-22192 Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage
Sources
Also known as GHSA-hrwg-p9c4-49wp.