CVE-2026-22192

MEDIUM

6.1

Descripcion

wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by importing a crafted options file with unescaped customCss field values. Attackers can supply a malicious JSON import file containing script payloads in the customCss parameter that execute on every page when rendered through the options handler without proper sanitization.

Detalles CVE

Puntuacion CVSS v3.16.1

SeveridadMEDIUM

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioREQUIRED

Publicado3/13/2026

Ultima modificacion3/17/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

gvectors:wpdiscuz

Debilidades (CWE)

CWE-79

Referencias

https://wordpress.org/plugins/wpdiscuz/(disclosure@vulncheck.com)

https://wordpress.org/plugins/wpdiscuz/#developers(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/wpdiscuz-before-stored-cross-site-scripting-via-malicious-options-import(disclosure@vulncheck.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.