CVE-2026-22204

This vulnerability allows attackers to send unwanted notification emails to multiple email addresses by exploiting a flaw in the wpDiscuz plugin, which does not limit how many subscriptions can be made. The attacker does not need to be logged in, making it easy for anyone to abuse this issue by sending specially crafted requests.

This vulnerability allows attackers to send unauthorized requests that can reveal or change user follow relationships on wpDiscuz without proper security checks. To exploit this, the attacker needs to trick a logged-in user into clicking a malicious link while they are on the site.

This vulnerability allows attackers to inject malicious JavaScript into comments on WordPress sites using the wpDiscuz plugin, which can then execute when other users view those comments. It requires the attacker to create specially crafted attachment records or use specific hooks to exploit the issue, affecting users who interact with the comments.

This vulnerability allows an attacker with admin access to inject harmful scripts into the website's custom CSS settings, which can then run arbitrary JavaScript in the browsers of users visiting the site. This means that if an attacker can log in as an admin, they can potentially execute malicious actions on users' devices.

This vulnerability allows attackers to access sensitive API secrets, such as social login credentials, if administrators accidentally export plugin settings as JSON files. This can happen through support tickets, backups, or version control systems, making it crucial for administrators to handle these exports carefully.