The wpDiscuz plugin for WordPress versions prior to 7.6.47 contains an improper neutralization of input vulnerability in the customCss field. Administrators can inject payloads such as </style><script>alert(1)</script> by breaking out of style tags, enabling execution of arbitrary JavaScript in the context of users' browsers. This cross-site scripting vulnerability requires admin privileges and does not depend on user interaction. No official patch or vendor advisory is provided in the input data, and no known exploits are reported in the wild.

Successful exploitation allows an attacker with administrative access to execute arbitrary JavaScript in the browsers of users viewing the affected pages. This can lead to session hijacking, defacement, or other malicious actions executed in the context of the affected site. Since the attacker must have admin privileges, the risk is limited to insiders or compromised admin accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and review custom CSS inputs carefully. Monitor for updates from gVectors regarding patches for this vulnerability.