wpDiscuz, the WordPress comment plugin running on more than 60,000 sites, shipped version 7.6.74 on October 29, 2026 to fix a stored cross-site scripting bug tracked as CVE-2026-119366. Every version through 7.6.73 is affected. The wpDiscuz vulnerability lets an attacker submit a comment under a crafted name that the plugin runs as a template fragment instead of showing as text, so embedded script executes for anyone who views it. If you run wpDiscuz, update to 7.6.74 now.
How the wpDiscuz Vulnerability Works
wpDiscuz uses curly-brace placeholders like {TEXT} internally to build parts of its comment templates. The researcher who reported the issue to Patchstack, known as AndrewN, found that the plugin never checked whether a visitor’s own commenter name also contained braces before rendering it. Submit a comment with a name built around that same placeholder syntax, and wpDiscuz treats the name as part of the template rather than plain text, letting the embedded script run.
That makes the bug easy to trigger. Patchstack and the National Vulnerability Database both list it as unauthenticated: no account on the site is needed, and the commenter name field does all the work on its own. The one real barrier is that a person has to view the comment, whether that’s a moderator checking the pending queue or a visitor loading the page after it’s approved. NVD scores it 7.1, High, under CVSS 3.1, vector AV:N/AC:L/PR:N/UI:R.
Who Should Patch This wpDiscuz Vulnerability
Any site running wpDiscuz for comments is exposed, regardless of whether moderation is turned on. Sites that auto-approve comments are worse off, since the script then runs for every visitor who loads the page rather than just the moderator reviewing the queue first. The fix is straightforward: update to wpDiscuz 7.6.74, which now renders any commenter name containing braces as plain text. If an immediate update isn’t possible, switching comment moderation to manual review limits the exposure to logged-in staff until the plugin is patched, though it doesn’t close the hole on its own.
It’s also a useful reminder that a plugin’s real attack surface includes every field a visitor controls, right down to a name box most people assume is harmless. A WordPress Development audit or ongoing Plugin Development support is what usually catches a gap like this in third-party code before it turns into a filed CVE.
