wpDiscuz Stored Cross-Site Scripting Vulnerability in Inline Comment Preview

A stored cross-site scripting vulnerability has been identified in wpDiscuz versions prior to 7.6.47. This issue resides within the inline comment preview feature, allowing authenticated users to inject malicious scripts by submitting comments with unescaped content. Attackers possessing unfiltered_html capabilities can directly embed JavaScript into comment content, which is then executed in the AJAX response from the getLastInlineComments() function in class.WpdiscuzHelperAjax.php, all without proper HTML escaping.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the comments.