The vulnerability in wpDiscuz prior to version 7.6.47 involves improper neutralization of input during web page generation in the customCss field. Specifically, administrators can inject payloads such as </style><script>alert(1)</script> by breaking out of style tags, enabling execution of arbitrary JavaScript in user browsers. This is a stored cross-site scripting vulnerability exploitable by users with administrative privileges.

An attacker with administrator access to wpDiscuz can inject malicious JavaScript code into the custom CSS setting. This code executes in the browsers of users who view the affected pages, potentially leading to session hijacking, defacement, or other script-based attacks. The impact is limited by the requirement of admin privileges to inject the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and avoid using the customCss field for untrusted input. Monitor vendor communications for updates and apply any official patches promptly once released.