CVE-2026-72725

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6

Description The staff action log model renders unescaped previous and new value fields, allowing the injection of stored cross-site scripting (XSS) into the staff interface. Stored XSS is a type of vulnerability where a malicious script is permanently stored on the target server and executed in the browser of a user who views the affected page.

Recommendations Update to version 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0.