CVE-2026-22210 wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs

What is CVE-2026-22210?

CVE-2026-22210 is a low-severity cross-site scripting vulnerability in gVectors wpDiscuz, published on 13 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting the WpdiscuzHelperUpload class. Attackers can craft malicious attachment records or filter hooks to inject arbitrary JavaScript into img and anchor tag attributes, executing code in the context of WordPress users viewing comments.

Weakness: CWE-79

Which versions are affected by CVE-2026-22210?

It affects 1 product.

Products include Gvectors Wpdiscuz.

How do I fix CVE-2026-22210?

No fix has been published for CVE-2026-22210 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-22210 being exploited?

There is no known exploitation of CVE-2026-22210 in the wild and no public exploit code.

Other vulnerabilities in gVectors wpDiscuz

• CVE-2020-24186 File upload in n/a Critical 10.0
• CVE-2024-9488 Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider Critical 9.8
• CVE-2020-13640 SQL injection in n/a Critical 9.8
• CVE-2026-22193 wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions() Critical 9.2
• CVE-2026-22192 Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-34jf-g4m6-4f57.