The vulnerability in wpDiscuz allows an authenticated user who has the unfiltered_html capability to store malicious JavaScript within comment content. The stored script is returned unescaped in an AJAX response from the getLastInlineComments() function, forming part of the inline comment preview. When a victim views the preview, the injected code executes in the victim’s browser, enabling defacement, session hijacking, or other client‑side attacks. This is a classic stored XSS flavor (CWE‑79) affecting confidentiality and integrity of the user session, but not providing a direct remote execution vector on the server side.

The flaw exists in wpDiscuz versions prior to 7.6.47, as provided by the gVectors Vendors product. Any WordPress installation running those affected plugin versions is potentially impacted.

The CVSS score of 5.3 indicates a moderate impact. The EPSS score of less than 1% suggests low anticipated exploitation frequency, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to be a logged‑in user with the unfiltered_html capability; thus the attack vector is authenticated and requires administrative or author‑level permissions. Because the payload is delivered via an AJAX response, the vulnerability is exploitable without additional steps beyond comment submission.