Discourse forums allow administrators to post topics. This vulnerability stems from insufficient sanitization of topic titles in the solved posts stream. As a result, an attacker could store malicious JavaScript in a title. When a user opens the solved stream, the injected script would execute in the victim’s browser, giving the attacker control over the client context. Based on the description, it is inferred that such execution could lead to session hijacking or other client‑side attacks.

Discourse, the open‑source discussion platform, is affected. All instances running any version earlier than the following patched releases are vulnerable: 2026.3.0-latest.1, 2026.2.1, and 2026.1.2. Versions that include the patch sanitize the title rendering for the solved stream. The affected products are identified by the CPE strings that reference the core Discourse application.

The CVSS base score of 5.4 indicates a moderate severity for this stored XSS flaw. The EPSS score of less than 1 % suggests a low probability of exploitation in the near term. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Attackers would need the ability to create or edit a topic in the solved stream and rely on users visiting that page to trigger the embedded script. While the likelihood of exploitation is low, the impact on user data and trust warrants prompt remediation.