vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-72729

Discourse: Stored XSS in discourse-local-dates plugin

LOW
2
CVSS Score
Published: August 10, 2026 at 04:15 PM UTC
Updated: September 8, 2026 at 09:09 PM UTC
1 product affected across 1 vendorDiscourse

Using discourse by discourse?

Get instant alerts when new vulnerabilities affect discourse - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
LOW2
Exploit prediction
EPSS 0.5%
SSVC
No known exploit

Description

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse-local-dates plugin rendered crafted local-date format data as HTML on sites with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Discourse· Discourse
60%
v < 2026.1.6v < 2026.5.2v < 2026.6.1
Affected range stops below 2026.1.6, so it looks safe — our inference, not a vendor statement
Affected range stops below 2026.5.2, so it looks safe — our inference, not a vendor statement
Affected range stops below 2026.6.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet, and no fixed version or vendor advisory is recorded against it.

References (5)

x_refsource_CONFIRM
Source: cverecord
https://github.com/discourse/discourse/security/advisories/GHSA-rw96-2xg7-h54g
x_refsource_MISC
Source: cverecord
https://github.com/discourse/discourse/commit/9768f476ed86ea202440cd2b6245af8a4f94ec69
x_refsource_MISC
Source: cverecord
https://github.com/discourse/discourse/commit/981ba23d33d2e2d98f6690734116af58f2cea938
x_refsource_MISC
Source: cverecord
https://github.com/discourse/discourse/commit/a7e509bfa1aa6288b447503de6ef798c31a62751
x_refsource_MISC
Source: cverecord
https://github.com/discourse/discourse/commit/d5d5055fbdf04d5bd72fcaa7e4257fac5adac049

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

2LOWGitHub_M
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card