VYPR
in the custom C","datePublished":"2026-03-13T19:54:11.003Z","dateModified":"2026-06-17T10:19:33.237Z","publisher":{"@type":"Organization","@id":"https://portal.vyprsec.ai#publisher","name":"VYPR","url":"https://portal.vyprsec.ai","logo":{"@type":"ImageObject","url":"https://portal.vyprsec.ai/icon.svg","width":64,"height":64},"description":"Real-time CVE intelligence newsroom — feeds, exploits, vendor advisories, and AI-synthesized insights."},"author":{"@type":"Organization","@id":"https://portal.vyprsec.ai#publisher","name":"VYPR","url":"https://portal.vyprsec.ai","logo":{"@type":"ImageObject","url":"https://portal.vyprsec.ai/icon.svg","width":64,"height":64},"description":"Real-time CVE intelligence newsroom — feeds, exploits, vendor advisories, and AI-synthesized insights."},"proficiencyLevel":"Expert","about":{"@type":"Thing","@id":"https://nvd.nist.gov/vuln/detail/CVE-2026-22209","name":"CVE-2026-22209","identifier":"CVE-2026-22209","description":"wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking out of style tags. Attackers with admin access can inject payloads like in the custom CSS setting to execute arbitrary JavaScript in user browsers.","additionalType":"https://schema.org/SoftwareApplication","sameAs":["https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22209"]},"keywords":"CVE-2026-22209, Medium, CWE-79, Gvectors Wpdiscuz, WordPress Wpdiscuz, Gvectors Wpdiscuz","mentions":[{"@type":"SoftwareApplication","name":"Wpdiscuz","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Gvectors"}},{"@type":"SoftwareApplication","name":"Wpdiscuz","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"WordPress"}},{"@type":"SoftwareApplication","name":"Wpdiscuz","applicationCategory":"SecurityApplication","publisher":{"@type":"Organization","name":"Gvectors"}}],"isAccessibleForFree":true},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://portal.vyprsec.ai/"},{"@type":"ListItem","position":2,"name":"CVEs","item":"https://portal.vyprsec.ai/cves"},{"@type":"ListItem","position":3,"name":"CVE-2026-22209","item":"https://portal.vyprsec.ai/cves/CVE-2026-22209"}]}]}
← All advisories
Medium severity5.5NVD Advisory· Published Mar 13, 2026· Updated Jun 17, 2026

CVE-2026-22209

CVE-2026-22209

Description

wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking out of style tags. Attackers with admin access can inject payloads like in the custom CSS setting to execute arbitrary JavaScript in user browsers.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.