CVE-2026-72725

Discourse (open‑source discussion platform) has a Stored XSS issue in the staff action log: prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields, enabling stored XSS in the staff interface. The vulnerability is fixed in versions 2026.1.6, 2026.5.2, 2026.6...