CVE-2026-107765

Name of the Vulnerable Software and Affected Versions Discussion Board – WordPress Forum Plugin versions prior to 2.6.1

Description Stored Cross-Site Scripting occurs via the user profile Website user url field. The issue stems from insufficient output escaping in the ctdb filter comment author name() callback hooked to get comment author link, which inserts the raw user url value into a single-quoted href attribute without using esc url() or esc attr(). Authenticated attackers with subscriber-level access or higher can inject arbitrary web scripts that execute when a user views a Discussion Board topic containing the attacker's reply.

Recommendations Update the plugin to a version newer than 2.6.0.