PT-2026-68859

CVE-2026-15032

Published

2026-08-03

Updated

2026-08-07

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.60

Description The plugin fails to properly escape a user-supplied URL before outputting it within an HTML attribute. This allows unauthenticated users to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server, which then execute in the browser of any user, including administrators, who views the affected content.

Recommendations Update wpDiscuz to version 7.6.60 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Hieus

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers