CVE-2026-22192
Stored XSS in wpDiscuz Options Import Allows Persistent Script Injection
Publication date: 2026-03-13
Last updated on: 2026-04-22
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gvectors | wpdiscuz | to 7.6.47 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2026-22192 is a stored cross-site scripting (XSS) vulnerability in wpDiscuz versions before 7.6.47. It allows authenticated attackers to inject malicious JavaScript code by importing a specially crafted JSON options file. This file contains malicious scripts embedded in the "customCss" field, which is not properly sanitized. As a result, the injected script executes on every page rendered through the options handler.'}] [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious JavaScript code in the context of your website. This can lead to unauthorized actions such as stealing user credentials, hijacking user sessions, defacing the website, or performing other malicious activities that compromise the confidentiality and integrity of your site and its users.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the import of a crafted JSON options file containing malicious JavaScript payloads in the customCss field. Detection would involve monitoring or inspecting imported options files for suspicious or unexpected script content within the customCss parameter.
Since the vulnerability requires an authenticated attacker to import a malicious JSON file, detection can include auditing import activities and examining the contents of imported options files for embedded script tags or JavaScript code.
Specific commands are not provided in the available resources. However, a general approach could be to search the wpDiscuz options import files or database entries for suspicious patterns such as <script> tags or JavaScript event handlers within the customCss field.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update wpDiscuz to version 7.6.47 or later, where the vulnerability has been fixed by implementing proper input sanitization on the options import feature.
Until the update can be applied, restrict or monitor the import of options files to prevent authenticated users from importing crafted JSON files containing malicious scripts.