WordPress Plugin Vulnerabilities

wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion

Description

The plugin does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected content.

Proof of Concept

Affects Plugins

Plugin icon
wpdiscuz
Fixed in 7.6.60

References

CVE
CVE-2026-15032

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
8.8 (high)

Miscellaneous

Original Researcher
hieus
Submitter
hieus
Verified
Yes
WPVDB ID
e77ea3fb-4d38-4fa7-a50b-1a0078f34474

Timeline

Publicly Published
2026-08-03 (about 25 days ago)
Added
2026-08-03 (about 25 days ago)
Last Updated
2026-08-27 (about 14 hours ago)

Other

Published
Title
Published
2022-12-27
Title
Search & Filter < 1.2.16 - Contributor+ Stored XSS
Published
2025-05-07
Title
Logo Showcase < 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-10-25
Title
Gutenberg 21.7 - 21.8 - Contributor+ Stored XSS
Published
2024-10-17
Title
Debrandify · Remove or Replace WordPress Branding < 1.1.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Published
2025-02-18
Title
XV Random Quotes <= 2.6.0 - Reflected XSS