CVE-2026-28554

This vulnerability allows attackers to send unwanted notification emails to multiple email addresses by exploiting a flaw in the wpDiscuz plugin, which does not limit how many subscriptions can be made. The attacker does not need to be logged in, making it easy for anyone to abuse this issue by sending specially crafted requests.

This vulnerability allows attackers to send unauthorized requests that can reveal or change user follow relationships on wpDiscuz without proper security checks. To exploit this, the attacker needs to trick a logged-in user into clicking a malicious link while they are on the site.

This vulnerability allows attackers to inject malicious JavaScript into comments on WordPress sites using the wpDiscuz plugin, which can then execute when other users view those comments. It requires the attacker to create specially crafted attachment records or use specific hooks to exploit the issue, affecting users who interact with the comments.

This vulnerability allows an attacker with admin access to inject harmful scripts into the website's custom CSS settings, which can then run arbitrary JavaScript in the browsers of users visiting the site. This means that if an attacker can log in as an admin, they can potentially execute malicious actions on users' devices.

This vulnerability allows attackers to manipulate email recipients by injecting harmful data into a specific cookie used by the wpDiscuz plugin. To exploit this, the attacker needs to craft a malicious cookie value that the system processes, which can lead to unauthorized emails being sent to unintended recipients.