WP
Product
wpDiscuz
33
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 4High 8Medium 21Low 0
Watch
Add wpDiscuz to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-24186 | 10.0 | Aug 24 | A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file,… Affected: 7.0 through 7.0.4 |
| CVE-2026-22192 | 9.9 | Mar 13 | Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage Affected: before 7.6.47 |
| CVE-2024-9488 | 9.8 | Oct 25 | Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider Affected: before 7.6.25 |
| CVE-2020-13640 | 9.8 | Jun 18 | A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a… Affected: through 5.3.5 |
| CVE-2023-45760 | 8.8 | Jan 2 | WordPress wpDiscuz plugin <= 7.6.3 - Broken Access Control vulnerability Affected: before 7.6.4 |
| CVE-2023-47775 | 8.8 | Nov 22 | WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Request Forgery (CSRF) Affected: before 7.6.12 |
| CVE-2022-43492 | 8.8 | Nov 18 | WordPress Comments – wpDiscuz plugin 7.4.2 - Auth. Insecure Direct Object References (IDOR) vulnerability Affected: 7.4.2 |
| CVE-2026-22199 | 7.5 | Mar 13 | Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi Affected: before 7.6.47 |
| CVE-2026-22193 | 7.5 | Mar 13 | wpDiscuz before 7.6.47 - SQL Injection in getAllSubscriptions() Affected: before 7.6.47 |
| CVE-2026-22182 | 7.5 | Mar 13 | wpDiscuz before 7.6.47 - Unauthenticated Email Notification Flood via wpdCheckNotificationType Affected: before 7.6.47 |
| CVE-2022-23984 | 7.5 | Feb 21 | WordPress wpDiscuz plugin <= 7.3.11 - Sensitive Information Disclosure Affected: through 7.3.11 |
| CVE-2023-46309 | 7.3 | Jan 2 | WordPress wpDiscuz plugin <= 7.6.10 - Broken Access Control vulnerability Affected: before 7.6.11 |
| CVE-2026-22202 | 6.5 | Mar 13 | wpDiscuz before 7.6.47 - Destructive GET Action Deletes All Comments by Email Affected: before 7.6.47 |
| CVE-2023-46311 | 6.5 | Dec 20 | WordPress wpDiscuz Plugin <= 7.6.3 is vulnerable to Insecure Direct Object References (IDOR) Affected: before 7.6.4 |
| CVE-2026-22210 | 6.1 | Mar 13 | wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Attachment URLs Affected: before 7.6.47 |
| CVE-2024-6704 | 6.1 | Aug 2 | Comments – wpDiscuz <= 7.6.21 - Unauthenticated HTML Injection Affected: before 7.6.22 |
| CVE-2023-46310 | 6.1 | Jun 4 | WordPress wpDiscuz plugin <= 7.6.10 - Content Injection vulnerability Affected: before 7.6.11 |
| CVE-2023-47185 | 6.1 | Nov 6 | WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Scripting (XSS) Affected: through 7.6.11 |
| CVE-2026-22209 | 5.5 | Mar 13 | wpDiscuz before 7.6.47 - Cross-Site Scripting via Unescaped Custom CSS in Style Tag Affected: before 7.6.47 |
| CVE-2026-22215 | 5.4 | Mar 13 | wpDiscuz before 7.6.47 - Missing CSRF Protection on wpdGetFollowsPage Affected: before 7.6.47 |
| CVE-2026-22183 | 5.4 | Mar 13 | wpDiscuz before 7.6.47 - Stored Cross-Site Scripting in Inline Comment Preview Affected: before 7.6.47 |
| CVE-2024-35681 | 5.4 | Jun 8 | WordPress wpDiscuz plugin <= 7.6.18 - Cross Site Scripting (XSS) vulnerability Affected: before 7.6.19 |
| CVE-2024-2477 | 5.4 | Apr 23 | wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text Affected: before 7.6.16 |
| CVE-2026-22216 | 5.3 | Mar 13 | wpDiscuz before 7.6.47 - No Rate Limiting on Subscription Endpoints with LIKE Wildcard Bypass Affected: before 7.6.47 |
| CVE-2026-22204 | 5.3 | Mar 13 | wpDiscuz before 7.6.47 - Unsanitized Cookie Email Used as wp_mail() Recipient Affected: before 7.6.47 |
| CVE-2026-22201 | 5.3 | Mar 13 | wpDiscuz before 7.6.47 - IP Address Spoofing in getIP() Affected: before 7.6.47 |
| CVE-2023-3869 | 5.3 | Oct 20 | wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decrease Affected: through 7.6.3 |
| CVE-2023-3998 | 5.3 | Oct 20 | wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decrease Affected: through 7.6.3 |
| CVE-2026-22191 | 5.2 | Mar 13 | Beghelli Sicuro24 SicuroWeb AngularJS Template Injection Affected: before 7.6.47 |
| CVE-2026-22203 | 4.9 | Mar 13 | wpDiscuz before 7.6.47 - Options Export Leaks OAuth Secrets in Plaintext Affected: before 7.6.47 |
| CVE-2023-51691 | 4.8 | Feb 1 | WordPress wpDiscuz Plugin <= 7.6.12 is vulnerable to Cross Site Scripting (XSS) Affected: through 7.6.12 |
| CVE-2021-24737 | 4.8 | Oct 11 | Comments - wpDiscuz <= 7.3.0 - Admin+ Stored Cross-Site Scripting Affected: through 7.3.0 |
| CVE-2021-24806 | 4.3 | Nov 8 | wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF Affected: before 7.3.4 |
Showing 33