Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking out of style tags. Attackers with admin access can inject payloads like </style><script>alert(1)</script> in the custom CSS setting to execute arbitrary JavaScript in user browsers.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-22209: thingino-firmware WiFi captive portal command injection bug - What It Means for Your Business and How to Respond https://hubs.li/Q048tXH80
Post summary
The article announces the command‑injection bug in Thingino firmware’s WiFi captive portal and hints at general response measures, but does not provide PoC, exploit code, active exploitation details, or specific patch information.
CVE-2026-22209 wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability in the customCss field that allows administrators to inject malicious scripts by breaking out of … https://www.cve.org/CVERecord?id=CVE-2026-22209
Post summary
The post announces the discovery of a cross‑site scripting flaw (CVE‑2026‑22209) in wpDiscuz, noting how administrators can inject scripts via the customCss field.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gvectors | wpdiscuz | - | wordpress | - |