The wpDiscuz Comments plugin for WordPress allows an unauthenticated attacker to inject arbitrary JavaScript by submitting a comment with a crafted value in the visitor "Website" field. The vulnerability arises because the comment_author_url is inserted directly into a single‑quoted attribute in the rendered comment without applying the required esc_url() or esc_attr() sanitisation, leaving stored‑79) exposure. When a user visits the page that contains the stored comment, the injected script executes in the user’s browser, enabling attacker‑controlled actions such as defacement, credential theft, or session hijacking.

This flaw affects installations of the AdvancedCoding wpDiscuz Comments plugin for WordPress running version 7.6.56 or earlier. Site administrators should verify the installed plugin version and determine whether the vulnerable code path is present in their deployment.

Valued at CVSS 7.2 the vulnerability is classified as high severity, yet it has an EPSS score of <1% and is not listed in the CISA KEV catalog, indicating that large‑scale exploitation is not currently widespread. The attack vector is unauthenticated and stored; an attacker can post a comment with a malicious Website field without any authentication, and the payload will be delivered to every visitor who loads the comment, giving the attacker a broad impact window.