Input validation vulnerability in Comments – wpDiscuz 7.6.11

The Comments plugin for WordPress, up to and including version 7.6.11, is vulnerable to a type of security breach known as Stored Cross-Site Scripting. This vulnerability can be exploited by unauthenticated attackers to inject malicious web scripts into pages which will be executed when a user visits the page. This is made possible due to the plugin’s insufficient input sanitization and output escaping when a file, such as an image, is uploaded as part of a comment submission.