CVE-2026-72730

Discourse: Stored XSS chat-transcript username unescaped in Rich Text Editor

High8.7EPSS 0.43%

Published: 10 Aug 2026
Updated: 10 Aug 2026
Reserved: 10 Aug 2026
Assigned by: GitHub_M

Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the Rich Text Editor rendered a chat-transcript username as HTML, allowing stored cross-site scripting. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Scores

CVSS scores of CVE-2026-72730, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	3.1	High8.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
NVDNVD · Deferred	3.1	High8.7	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

EPSS (exploitation in 30 days): 0.43% · top 63% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.7.

Weakness

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

discourse · discourse
- affected < 2026.1.6
- affected >= 2026.5.0-latest, < 2026.5.2
- affected >= 2026.6.0-latest, < 2026.6.1

References (5)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-72730](https://trackcve.app/badge/CVE-2026-72730.svg)](https://trackcve.app/cve/CVE-2026-72730)

Record last updated 10 Aug 2026, 18:34 UTC.