Mickeyjoe

**Name of the Vulnerable Software and Affected Versions** wpDiscuz versions prior to 7.6.57 **Description** Stored Cross-Site Scripting occurs when the plugin fails to properly escape output in the `getCommentAuthor()` function. This happens because the `comment author url` value, provided in the guest commenter Website field, is interpolated directly into single-quoted HTML attributes without using `esc url()` or `esc attr()`. An unauthenticated attacker can submit a crafted comment containing a malicious payload in the Website field, which is then stored and executed in the browser of any user, including administrators, who views the affected page. This can lead to session hijacking, account takeover, and content manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.