wpDiscuz before version 7.6.47 includes a stored cross‑site scripting flaw that permits an authenticated user to inject malicious JavaScript. The attack works through the plugin’s options import feature, where a crafted JSON file containing script payloads in the customCss field is accepted without proper sanitization. Once imported, the malicious code is persisted and rendered on every page that references the options, allowing the attacker to execute arbitrary scripts in visitors’ browsers, hijack sessions, steal cookies or deliver malware. This weakness is classified as CWE‑79: Improper Neutralization of Input During Web Page Generation.

Affected systems are installations of the wpDiscuz plugin from gVectors for WordPress. All releases prior to version 7.6.47 are potentially vulnerable. The defect is tied to the options import functionality, which is available to any user with write permissions to the plugin settings.

The CVSS score of 6.3 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated as an administrator or a user with permission to import options. Once the malicious JSON file is uploaded, the stored XSS is triggered whenever a page renders the options, making the attack relatively simple for an attacker who has the necessary privileges.