An improper neutralization of input leads to a stored cross‑site scripting vulnerability in the AdvancedCoding wpDiscuz WordPress plugin. The flaw allows an attacker to inject malicious scripts that are persisted in the database and served to any user who views the affected content. This can enable session hijacking, defacement, or theft of sensitive information via the victim’s browser. The weakness is a classic stored XSS, cataloged as CWE‑79.

Affects the WordPress wpDiscuz plugin version 7.6.73 and earlier. Any WordPress site that has AdvancedCoding wpDiscuz installed in a version from the initial release through 7.6.73 is vulnerable.

The CVSS score of 7.1 indicates a high risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely through user‑generated content such as comment submissions that are stored and rendered without proper escaping. Prompt patching is recommended because successful exploitation would give attackers arbitrary script execution in the context of the site visitor.