CVE-2021-24737

The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2021-24737 Comments - wpDiscuz <= 7.3.0 - Admin+ Stored Cross-Site Scripting

The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2021-24737

CVE-2021-24737 affects the WordPress wpDiscuz plugin up to v7.3.0. It fails to sanitize/escape Follow and Unfollow messages, enabling Stored XSS by high-privilege users even when unfiltered_html is disallowed. Exploitation vectors are via output on pages and documented PoCs exist in multiple sour...