CVE-2026-22216

This vulnerability allows attackers to send unauthorized requests that can reveal or change user follow relationships on wpDiscuz without proper security checks. To exploit this, the attacker needs to trick a logged-in user into clicking a malicious link while they are on the site.

This vulnerability allows attackers to inject malicious JavaScript into comments on WordPress sites using the wpDiscuz plugin, which can then execute when other users view those comments. It requires the attacker to create specially crafted attachment records or use specific hooks to exploit the issue, affecting users who interact with the comments.

This vulnerability allows an attacker with admin access to inject harmful scripts into the website's custom CSS settings, which can then run arbitrary JavaScript in the browsers of users visiting the site. This means that if an attacker can log in as an admin, they can potentially execute malicious actions on users' devices.

This vulnerability allows attackers to manipulate email recipients by injecting harmful data into a specific cookie used by the wpDiscuz plugin. To exploit this, the attacker needs to craft a malicious cookie value that the system processes, which can lead to unauthorized emails being sent to unintended recipients.

This vulnerability allows attackers to access sensitive API secrets, such as social login credentials, if administrators accidentally export plugin settings as JSON files. This can happen through support tickets, backups, or version control systems, making it crucial for administrators to handle these exports carefully.