# CVE-2026-107765: The Discussion Board stored cross-site scripting in user profile

Source: https://junglewise.ai/threats/cve-2026-107765-the-discussion-board-wordpress-forum-plugin-plugin-for-wordpress  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-31. Updated: 2026-10-31  
License: CC BY 4.0 with a link back

CVE-2026-107765 · Severity: medium · CVSS 6.4 · Published 2026-10-31

The Discussion Board is a WordPress forum plugin that allows users to participate in discussions and manage profiles. An authenticated attacker with subscriber-level access or higher can inject malicious scripts into their user profile's website field, which will execute for other users viewing forum topics containing the attacker's replies. This could lead to account compromise, credential theft, or malware distribution to forum members.

Vendors: [WordPress.org](https://junglewise.ai/threats/vendors/wordpress-org).

## Quick answers

**Is CVE-2026-107765 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107765 being exploited in the wild.

**How severe is CVE-2026-107765?** Medium severity, with a CVSS score of 6.4, published 31 October 2026.

**Which products and versions are affected?** WordPress.org The Discussion Board up to and including 2.6.0.

**Is there a fix for CVE-2026-107765?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-107765 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-107765?** Check whether you run WordPress.org The Discussion Board at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to properly escape the user_url profile field when rendering comment author links in the ctdb_filter_comment_author_name() callback. An authenticated subscriber can inject arbitrary HTML and JavaScript into the website URL field, which is then inserted unescaped into single-quoted href attributes on public forum pages. The vulnerability is triggered whenever another user views a Discussion Board topic containing the attacker's comment.

## Affected products

- wordpress.org The Discussion Board up to and including 2.6.0

## Timeline

- 2026-10-31: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/wp-discussion-board/tags/2.6.0/includes/functions/functions-skins.php](https://plugins.trac.wordpress.org/browser/wp-discussion-board/tags/2.6.0/includes/functions/functions-skins.php)
- [https://plugins.trac.wordpress.org/browser/wp-discussion-board/tags/2.6.0/includes/functions/functions-user.php](https://plugins.trac.wordpress.org/browser/wp-discussion-board/tags/2.6.0/includes/functions/functions-user.php)