CVE-2026-107765
CVE-2026-107765
The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 via the user profile Website (user_url) field. This is due to insufficient output escaping in the ctdb_filter_comment_author_name() callback hooked to get_comment_author_link, which interpolates the raw user_url value into a single-quoted href attribute without esc_url() or esc_attr(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a Discussion Board topic containing the attacker's reply.
Fixes and workarounds
No remediation reported in collected sources.
Missing remediation information is not evidence that no patch exists.
Affected products and versions
No affected-product ranges reported in collected sources.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 6.4 medium |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | NVD: [email protected] |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://plugins.trac.wordpress.org/browser/wp-discussion-board/tags/2.6.0/includes/functions/functions-skins.php#L43[email protected]
- https://plugins.trac.wordpress.org/browser/wp-discussion-board/tags/2.6.0/includes/functions/functions-user.php#L83[email protected]
- https://plugins.trac.wordpress.org/browser/wp-discussion-board/tags/2.6.0/includes/functions/functions-user.php#L92[email protected]
- https://plugins.trac.wordpress.org/changeset/3761217/wp-discussion-board/trunk/includes/functions/functions-user.php[email protected]
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5dbb177e-3cf8-48fe-9660-999c177cbeb5?source=cve[email protected]