CVE-2026-22209

This vulnerability allows attackers to send unwanted notification emails to multiple email addresses by exploiting a flaw in the wpDiscuz plugin, which does not limit how many subscriptions can be made. The attacker does not need to be logged in, making it easy for anyone to abuse this issue by sending specially crafted requests.

This vulnerability allows attackers to send unauthorized requests that can reveal or change user follow relationships on wpDiscuz without proper security checks. To exploit this, the attacker needs to trick a logged-in user into clicking a malicious link while they are on the site.

This vulnerability allows attackers to inject malicious JavaScript into comments on WordPress sites using the wpDiscuz plugin, which can then execute when other users view those comments. It requires the attacker to create specially crafted attachment records or use specific hooks to exploit the issue, affecting users who interact with the comments.

This vulnerability allows attackers to manipulate email recipients by injecting harmful data into a specific cookie used by the wpDiscuz plugin. To exploit this, the attacker needs to craft a malicious cookie value that the system processes, which can lead to unauthorized emails being sent to unintended recipients.

This vulnerability allows attackers to access sensitive API secrets, such as social login credentials, if administrators accidentally export plugin settings as JSON files. This can happen through support tickets, backups, or version control systems, making it crucial for administrators to handle these exports carefully.