The Comments WordPress plugin does not correctly escape a user‑supplied image URL before displaying it in an HTML attribute. This flaw allows an unauthenticated attacker to store a malicious payload that executes in the browsers of any user who views the affected content, including site administrators. The result is a classic Stored XSS vulnerability (CWE-79) that can compromise confidentiality, integrity, and availability of the site and its users.

wpDiscuz versions earlier than 7.6.60 are affected. Users of the plugin on WordPress installations should verify that they are not running a vulnerable build of the plugin.

This vulnerability can be exploited by anyone without requiring authentication, meaning attackers can inject the payload directly into the stored content. The CVSS score of 6.1 indicates a moderate severity, and the EPSS score is less than 1%. The flaw is not listed in CISA’s KEV catalog. Nonetheless, the ease of exploitation and the potential impact of Stored XSS dictate a high risk posture. An attacker could steal session cookies, deface the site, or deliver further malicious content to site visitors.