wpdiscuz vulnerabilities and fixes

Recent CVEs affecting wpdiscuz, with upgrade or downgrade steps. 20 tracked.

wpdiscuz has 20 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 20. Most recent: 2026-03-13. Highest priority: CVE-2024-9488 (score 54/100).

• CVE-2026-22216 MEDIUM 6.5 UPGRADE wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to
• CVE-2026-22215 MEDIUM 4.3 UPGRADE wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function th
• CVE-2026-22210 MEDIUM 4.4 UPGRADE wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious
• CVE-2026-22209 MEDIUM 5.5 UPGRADE wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows admini
• CVE-2026-22204 LOW 3.7 UPGRADE wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate ma
• CVE-2026-22203 MEDIUM 4.9 UPGRADE wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvert
• CVE-2026-22202 HIGH 8.1 UPGRADE wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all
• CVE-2026-22201 MEDIUM 5.3 UPGRADE wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to
• CVE-2026-22199 HIGH 7.5 UPGRADE Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upl
• CVE-2026-22193 HIGH 8.1 UPGRADE wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where str
• CVE-2026-22192 CRITICAL 9.9 UPGRADE Voltronic Power SNMP Web Pro version 1.1 contains an authentication bypass vulnerability that allows unauthent
• CVE-2026-22191 MEDIUM 5.2 UPGRADE Beghelli Sicuro24 SicuroWeb contains a template injection vulnerability that allows attackers to inject arbitr
• CVE-2026-22183 MEDIUM 6.1 UPGRADE wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview func
• CVE-2026-22182 HIGH 7.5 UPGRADE wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users
• CVE-2024-9488 CRITICAL 9.8 UPGRADE The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and
• CVE-2024-6704 MEDIUM 5.3 UPGRADE The Comments – wpDiscuz plugin for WordPress is vulnerable to HTML Injection in all versions up to, and includ
• CVE-2024-35681 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in g
• CVE-2024-2477 MEDIUM 6.4 UPGRADE The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' fiel
• CVE-2023-46309 MEDIUM 5.3 UPGRADE Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configur
• CVE-2023-45760 MEDIUM 4.3 UPGRADE Missing Authorization vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configur

FAQ

How do I fix wpdiscuz vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is wpdiscuz being exploited right now?

None of the tracked wpdiscuz CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which wpdiscuz CVE should I patch first?

CVE-2024-9488 currently ranks highest (54/100): The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and.

RSS feed for wpdiscuz · ← Back to latest CVEs