CVE-2026-22209

7.6.47 dan oldingi wpDiscuz, customCss maydonida administratorlarga uslub teglarini buzib zararli skriptlarni kiritish imkonini beruvchi saytlararo skript zaifligini o&#39;z ichiga oladi. Administratorga kirish huquqiga ega bo&#39;lgan hujumchilar quyidagi kabi foydali yuklamalarni kiritishlari mumkin. </style><script>alert(1)</script> foydalanuvchi brauzerlarida ixtiyoriy JavaScript-ni bajarish uchun maxsus CSS sozlamasida.

CVSS Vector

Manbalar

• https://wordpress.org/plugins/wpdiscuz/
• https://wordpress.org/plugins/wpdiscuz/#developers
• https://www.vulncheck.com/advisories/wpdiscuz-before-cross-site-scripting-via-unescaped-custom-css-in-style-tag