CVE-2026-9148 is a stored cross-site scripting vulnerability in the Comments – wpDiscuz WordPress plugin. The issue arises because the getCommentAuthor() function interpolates the stored comment_author_url value directly into single-quoted HTML attributes without applying proper escaping functions such as esc_url() or esc_attr(). This allows unauthenticated attackers to inject malicious scripts via the guest commenter 'Website' field, which execute in the context of users visiting the injected pages. The vulnerability affects all plugin versions up to and including 7.6.56.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browsers of users who view the injected comments. This can lead to information disclosure, session hijacking, or other client-side attacks. The vulnerability does not impact availability but compromises confidentiality and integrity of user interactions on affected sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling guest comments or sanitizing input fields via custom code as a temporary mitigation. Monitor the vendor's communications for updates on patches or official fixes.