wpDiscuz vulnerabilities

The wpDiscuz plugin by AdvancedCoding up to 7.6.73 does not properly neutralize input during web page generation, allowing a Stored XSS attack. The issue affects versions from n/a through 7.6.73.

The Comments – wpDiscuz plugin for WordPress up to version 7.6.56 is vulnerable to Stored Cross-Site Scripting. The vulnerability exists in the getCommentAuthor() function, which fails to properly escape the guest commenter 'Website' field before inserting it into single-quoted HTML attributes. This allows unauthenticated attackers to inject arbitrary scripts that execute when users view affected pages.

Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz (up to 7.6.43) allows exploiting incorrectly configured access control security levels.

The wpDiscuz plugin up to version 7.6.33 has a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects the plugin's authorization mechanism.