CVE-2026-72730 — Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing …
Published: 2026-08-10 · CVSS: 8.7 · CVSS 3.1
Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7