CVE-2026-72725 — Discourse: Stored XSS in staff action logs injects staff UI
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-si…
Published: 2026-08-10 · CVSS: 5.4 · CVSS 3.1
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7