This vulnerability in wpDiscuz arises from improper input sanitization during web page generation, classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). It allows stored cross-site scripting (XSS) attacks, where malicious scripts can be injected and later executed in the context of users viewing the affected pages. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring low privileges and user interaction, with impacts on confidentiality, integrity, and availability rated as low to low to low respectively, but with scope changed. The affected versions include all versions up to 7.6.18. No patch or official fix has been announced yet.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users interacting with the wpDiscuz plugin, potentially leading to information disclosure, session hijacking, or other client-side impacts. The CVSS score of 6.5 reflects a medium severity with impacts on confidentiality, integrity, and availability. However, exploitation requires user interaction and low privileges, which somewhat limits the risk. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider limiting privileges for users who can submit content through wpDiscuz and monitor for suspicious activity. Avoid clicking on untrusted links or content generated via the plugin. Follow vendor channels for updates on patches or official mitigations.