# CVE-2026-9148: advancedcoding wpDiscuz Stored XSS in guest Website field

Source: https://junglewise.ai/threats/cve-2026-9148-advancedcoding-wpdiscuz-stored-xss-in-guest-website-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-03. Updated: 2026-07-03  
License: CC BY 4.0 with a link back

CVE-2026-9148 · Severity: high · CVSS 7.2 · Published 2026-07-03

The wpDiscuz plugin for WordPress, which provides an enhanced comment system for websites, contains a security flaw in its guest comment feature. An attacker can submit a malicious link in the 'Website' field that executes harmful code in the browsers of other visitors or site administrators. This could lead to unauthorized actions being performed on the site or the theft of sensitive session information.

Vendors: [gVectors Team](https://junglewise.ai/threats/vendors/gvectors-team).

## Quick answers

**Is CVE-2026-9148 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9148 being exploited in the wild.

**How severe is CVE-2026-9148?** High severity, with a CVSS score of 7.2, published 3 July 2026.

**Which products and versions are affected?** gVectors Team wpDiscuz up to, and including, 7.6.56.

**Is there a fix for CVE-2026-9148?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9148 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9148?** Check whether you run gVectors Team wpDiscuz at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient output escaping in the getCommentAuthor() function. Specifically, the function interpolates the 'comment_author_url' value directly into single-quoted HTML attributes without utilizing protective functions like esc_url() or esc_attr(). This allows unauthenticated remote attackers to inject arbitrary web scripts via the 'Website' field during guest comment submission. The injected scripts are stored in the database and executed in the context of any user (including administrators) who visits the page where the comment is displayed. The issue is fixed in version 7.6.57.

## Affected products

- advancedcoding Comments – wpDiscuz up to, and including, 7.6.56

## Timeline

- 2026-07-03: disclosed
- 2026-07-03: advisory

## References

- [https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.48/forms/wpdFormAttr/Field/DefaultField/Website.php](https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.48/forms/wpdFormAttr/Field/DefaultField/Website.php)
- [https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.48/forms/wpdFormAttr/Tools/Sanitizer.php](https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.48/forms/wpdFormAttr/Tools/Sanitizer.php)
- [https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.48/utils/class.WpdiscuzHelper.php](https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.48/utils/class.WpdiscuzHelper.php)
- [https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.48/utils/class.WpdiscuzHelper.php](https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.48/utils/class.WpdiscuzHelper.php)
- [https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.54/forms/wpdFormAttr/Field/DefaultField/Website.php](https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.54/forms/wpdFormAttr/Field/DefaultField/Website.php)
- [https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.54/forms/wpdFormAttr/Tools/Sanitizer.php](https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.54/forms/wpdFormAttr/Tools/Sanitizer.php)
- [https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.54/utils/class.WpdiscuzHelper.php](https://plugins.trac.wordpress.org/browser/wpdiscuz/tags/7.6.54/utils/class.WpdiscuzHelper.php)